ab9398d66368aa69c3b53b9e7b0d3790N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ab9398d66368aa69c3b53b9e7b0d3790N.exe
Size

552KB
MD5

ab9398d66368aa69c3b53b9e7b0d3790
SHA1

d9b4ca3b50bfc5f5840dceaf5ae3d687a2d7fcde
SHA256

77b246ce2d71c45b69f5204ea6c7174752334024a3e96e9f96ff500c07a96af5
SHA512

4c3b46b5bac50631586019002a55676b07953ebb111f5c8d0696af36f1d052b54d1d4c5baacacf1526524af80bfecb2838b6c0db69ca5ed51530a61702e63475
SSDEEP

12288:gKdW/Je4h9W+KQzdmwNEYhzuNswr6HFlch0tTb:gmxe9FXPEk4swr6lqeB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab9398d66368aa69c3b53b9e7b0d3790N.exe

Files

ab9398d66368aa69c3b53b9e7b0d3790N.exe
.exe windows:4 windows x86 arch:x86

3040cf8cc36e24c00b0f2bd970073cac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\ekwx\bctaul\deb\lwieh\wpz.pdb

Imports

user32

InSendMessageEx
ActivateKeyboardLayout
CharNextA
ChangeDisplaySettingsA
MessageBoxIndirectW
GetNextDlgGroupItem
UnregisterClassA
DefWindowProcA
GetUserObjectInformationA
DdeConnectList
WaitForInputIdle
RegisterClassA
SetWindowTextA
GetWindowTextW
DefFrameProcW
ReleaseCapture
GetAncestor
AppendMenuW
TrackPopupMenu
CreateWindowExA
ImpersonateDdeClientWindow
TabbedTextOutA
DrawFrame
SetMenu
GetOpenClipboardWindow
DdeCreateStringHandleA
GetClassInfoA
SendNotifyMessageA
TabbedTextOutW
DestroyWindow
CreateDialogParamA
GetProcessDefaultLayout
LoadKeyboardLayoutA
ShowWindow
PaintDesktop
RegisterClassW
RegisterClassExA
MessageBoxW
SetKeyboardState
RegisterWindowMessageW
AnyPopup
MapVirtualKeyExA
ClientToScreen
SetCursor
CharUpperBuffW
DlgDirSelectComboBoxExA
DrawCaption

kernel32

RtlUnwind
ReadConsoleOutputW
GetLastError
FindResourceExW
GlobalFindAtomW
GetSystemTime
LoadLibraryExW
HeapFree
GetConsoleOutputCP
HeapReAlloc
GetCurrentThread
InterlockedExchange
EnterCriticalSection
IsBadWritePtr
VirtualFree
InterlockedIncrement
TlsFree
IsValidLocale
TerminateProcess
GetCurrentProcessId
GetModuleHandleA
TlsGetValue
SetFilePointer
GetVersion
OpenProcess
OpenEventW
SetEnvironmentVariableA
CompareStringW
ReadConsoleInputA
SetFileAttributesA
OpenMutexA
GetEnvironmentStrings
GetCPInfo
CreateMutexA
GetSystemDirectoryW
HeapDestroy
LeaveCriticalSection
CloseHandle
MultiByteToWideChar
ReadFile
GetCurrentThreadId
InitializeCriticalSection
GetSystemTimeAsFileTime
HeapAlloc
SetLastError
SetConsoleScreenBufferSize
GetStringTypeA
CompareStringA
lstrcpyW
TlsSetValue
EnumSystemLocalesW
SetHandleCount
GetCurrentProcess
SetVolumeLabelA
QueryPerformanceCounter
DeleteCriticalSection
GetProcAddress
FlushFileBuffers
FreeEnvironmentStringsA
VirtualQuery
GetModuleFileNameA
LCMapStringA
GetConsoleTitleA
CreateFileA
InterlockedDecrement
GetStdHandle
LCMapStringW
SetSystemTime
WriteConsoleOutputCharacterA
GetPrivateProfileSectionNamesW
RtlMoveMemory
SetVolumeLabelW
GetTickCount
EnumResourceTypesA
WriteConsoleA
GetEnvironmentStringsW
TlsAlloc
SetStdHandle
GetNumberFormatW
GetLocalTime
FreeEnvironmentStringsW
ReadConsoleA
ResetEvent
WriteFile
LoadLibraryA
UnhandledExceptionFilter
lstrcmpi
GetFileType
WideCharToMultiByte
GetCommandLineA
ExitProcess
HeapCreate
VirtualFreeEx
GetStartupInfoA
VirtualAlloc
GetACP
GetTimeZoneInformation
WritePrivateProfileStructA
GetExitCodeProcess
GetOEMCP
GetStringTypeW

advapi32

CryptAcquireContextW
StartServiceW

comctl32

CreateStatusWindow
CreateStatusWindowA
ImageList_GetImageRect
ImageList_Create
ImageList_Replace
ImageList_GetFlags
InitCommonControlsEx
ImageList_LoadImageA
_TrackMouseEvent
CreateUpDownControl
DestroyPropertySheetPage
ImageList_GetDragImage
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_Remove
ImageList_GetImageInfo
ImageList_Write
ImageList_LoadImage
ImageList_DragEnter

Sections

.text
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3040cf8cc36e24c00b0f2bd970073cac

Headers

File Characteristics

PDB Paths

Imports

user32

kernel32

advapi32

comctl32

Sections

.text Size: 152KB - Virtual size: 149KB

.rdata Size: 248KB - Virtual size: 246KB

.data Size: 116KB - Virtual size: 127KB

.rsrc Size: 32KB - Virtual size: 31KB

.text
Size: 152KB - Virtual size: 149KB

.rdata
Size: 248KB - Virtual size: 246KB

.data
Size: 116KB - Virtual size: 127KB

.rsrc
Size: 32KB - Virtual size: 31KB