1a59c7fdc8f2ec5ced605f0664eab4a0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1a59c7fdc8f2ec5ced605f0664eab4a0N.exe
Size

5.2MB
MD5

1a59c7fdc8f2ec5ced605f0664eab4a0
SHA1

b8116e6c534e65312354c80a2279c60326dc5b0c
SHA256

7a09b5a8792d58569c96043afff4576106c3027268a68f1ba5c99544724f0b16
SHA512

85380543bf0d5749cdc54838316c239abaf634c05d9bb932d3ec87530cc552303f9bccd3dd2364343112f6cf4618b8528daaec633482abbc5b9c1ef3a537993d
SSDEEP

98304:xVzhHdFZXYBrcWe8qkHFXi+CCCyKySaxQNI0z9IKdvFvbCyNPIIjX5PVwt5WGqs/:lHOr2+CCCyKySaxQN7P4WG/ZHk2lW2a2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a59c7fdc8f2ec5ced605f0664eab4a0N.exe

Files

1a59c7fdc8f2ec5ced605f0664eab4a0N.exe
.exe windows:4 windows x86 arch:x86

bb173fe537404f2f82ddf8cb501ef6a5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
MoveFileW
GetCurrentThreadId
WaitForMultipleObjects
CloseHandle
CompareStringW
TlsSetValue
GetStringTypeW
VirtualFree
EnterCriticalSection
FreeEnvironmentStringsA
FileTimeToLocalFileTime
GetDriveTypeA
QueryPerformanceFrequency
HeapAlloc
LeaveCriticalSection
GetFileSize
LoadLibraryA
GetEnvironmentStrings
TerminateProcess
GetProcAddress
MoveFileExA
FindFirstFileA
TlsGetValue
DeleteCriticalSection
HeapDestroy
RtlUnwind
LCMapStringA
WideCharToMultiByte
CreateThread
GetFullPathNameA
GetTickCount
SetLastError
GetFileInformationByHandle
GetACP
HeapReAlloc
SleepEx
InitializeCriticalSection
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
GetStringTypeA
WriteFile
GetModuleFileNameW
TlsAlloc
GetEnvironmentVariableA
GetCurrentProcess
GetLastError
GetStartupInfoW
SetEnvironmentVariableA
SetEndOfFile
FreeEnvironmentStringsW
GetModuleHandleW
GetFileType
SetFilePointer
GetCurrentDirectoryA
SetHandleCount
InterlockedIncrement
GetCommandLineW
HeapFree
ExitProcess
FlushFileBuffers
GetFileSizeEx
GetVersionExA
QueryPerformanceCounter
FileTimeToSystemTime
GetCurrentProcessId
GetStdHandle
WaitForSingleObject
CompareStringA
FormatMessageA
GetSystemDirectoryA
FreeLibrary
PeekNamedPipe
LCMapStringW
GetModuleHandleA
GetSystemTime
HeapCreate
Sleep
SetStdHandle
GetLocalTime
GetCommandLineA
CreateFileA
VirtualAlloc
FindClose
MultiByteToWideChar
ExitThread
InterlockedDecrement
GetStartupInfoA
GetFileAttributesA
GetModuleFileNameA
UnhandledExceptionFilter
GetProcessHeap
DeleteFileA
ReadFile
GetCurrentThread
GetTimeZoneInformation

user32

GetWindowRect
PostQuitMessage
GetClientRect
GetSystemMetrics
BeginPaint
DefWindowProcW
UpdateWindow
CreateWindowExW
LoadIconW
EndPaint
MessageBoxA
SetWindowPos
ShowWindow
FillRect
PostMessageW
SendMessageA
GetMessageW
RegisterClassExW
RedrawWindow
DrawTextW
DispatchMessageW
TranslateMessage

gdi32

CreateSolidBrush
DeleteObject
SetTextColor
SetBkMode

advapi32

CryptImportKey
CryptDestroyHash
CryptReleaseContext
CryptEncrypt
CloseServiceHandle
CryptDestroyKey
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA

crypt32

CertFreeCertificateContext
CertGetCertificateChain
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CryptStringToBinaryA
CertFindCertificateInStore
CryptQueryObject
PFXImportCertStore
CertFreeCertificateChainEngine
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertFindExtension

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord45
ord60
ord22
ord211
ord26
ord143
ord50
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohl
listen

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb173fe537404f2f82ddf8cb501ef6a5

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 204KB - Virtual size: 201KB

.data Size: 56KB - Virtual size: 75KB

.rsrc Size: 68KB - Virtual size: 68KB

.reloc Size: 52KB - Virtual size: 49KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 204KB - Virtual size: 201KB

.data
Size: 56KB - Virtual size: 75KB

.rsrc
Size: 68KB - Virtual size: 68KB

.reloc
Size: 52KB - Virtual size: 49KB