6a9d46e8a0a749c38a9b3413bb99df9e6d41d107d14af99d6d93f78d48a4dc20

Sharing

Copy URL Twitter E-mail

General

Target

6a9d46e8a0a749c38a9b3413bb99df9e6d41d107d14af99d6d93f78d48a4dc20
Size

461KB
MD5

0277090b036ee54fc6d8fb5aef912886
SHA1

5ba8b734c14b592eae3845b801371537c237b867
SHA256

6a9d46e8a0a749c38a9b3413bb99df9e6d41d107d14af99d6d93f78d48a4dc20
SHA512

ca59dbca40cb04d0fa7ffccea7445f58b6e8dd3553d55daba7c7885385ee973ac21a474f5d39f5085a90a0c2320e8c17ffe9bf3853972bb31dc2adfcc7012f0b
SSDEEP

12288:L1vznxHb9KOQRZ66z24VZbdrpgrXN2LWzmidNPxr8:5vFH5KO6Z66z24VZbFpgJ2LWzmidNPxY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a9d46e8a0a749c38a9b3413bb99df9e6d41d107d14af99d6d93f78d48a4dc20

Files

6a9d46e8a0a749c38a9b3413bb99df9e6d41d107d14af99d6d93f78d48a4dc20
.exe windows:10 windows x86 arch:x86

c6e1b8202aded47b7c2380a87886d20c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

regedit.pdb

Imports

advapi32

RegOpenKeyW
RegDeleteValueW
RegCreateKeyW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegEnumKeyW
RegLoadKeyW
RegUnLoadKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegRenameKey
GetSecurityInfo
RegQueryValueExW
OpenProcessToken
RegSetKeySecurity
GetSecurityDescriptorControl
AdjustTokenPrivileges
LookupPrivilegeValueW
RegConnectRegistryW
RegEnumValueW
SetSecurityDescriptorGroup
LookupAccountSidW
MapGenericMask
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
SetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegFlushKey
GetSidSubAuthority
GetSecurityDescriptorGroup
GetSidSubAuthorityCount
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegSetValueW
RegRestoreKeyW
RegSetValueExA
RegSaveKeyW
GetInheritanceSourceW
RegCloseKey

kernel32

GetModuleHandleExW
FreeLibrary
GetTimeFormatW
FileTimeToLocalFileTime
LoadLibraryW
FileTimeToSystemTime
lstrcmpW
WideCharToMultiByte
GetFileSize
DeleteFileW
MultiByteToWideChar
CreateFileW
SetFilePointer
WriteFile
SearchPathW
ReadFile
GetCurrentProcess
ExitProcess
HeapSetInformation
GetLongPathNameW
GetCommandLineW
lstrcmpiW
LocalAlloc
IsDebuggerPresent
RegisterApplicationRestart
GetDateFormatW
GlobalAlloc
GetProcAddress
GlobalLock
GetModuleHandleW
LocalReAlloc
DebugBreak
GlobalUnlock
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
CompareStringOrdinal
WaitForSingleObject
MulDiv
GetProcessHeap
GetCurrentProcessId
GetComputerNameW
LocalFree
CreateMutexExW
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
HeapAlloc
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
Sleep
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetModuleFileNameA

gdi32

GetStockObject
GetTextExtentPoint32W
StartPage
AbortDoc
EndDoc
DeleteDC
SetViewportOrgEx
SetAbortProc
StartDocW
EndPage
CreatePatternBrush
CreateBitmap
PatBlt
SelectClipRgn
GetObjectW
ExcludeClipRect
SelectObject
GetDeviceCaps
GetTextMetricsW
SetTextColor
SetBkColor
DeleteObject
CreateFontIndirectW
ExtTextOutW

user32

IsIconic
GetDpiForSystem
LoadMenuW
LoadImageW
UpdateWindow
DialogBoxParamW
PostQuitMessage
CheckMenuItem
GetSystemMetricsForDpi
SetCursor
InsertMenuW
EndDeferWindowPos
DrawMenuBar
GetProcessDefaultLayout
LoadIconW
TranslateMessage
TranslateAcceleratorW
GetSysColor
SetThreadDpiAwarenessContext
SetMenuDefaultItem
SetWindowPlacement
SetMenuItemInfoW
ClientToScreen
DestroyIcon
DispatchMessageW
BeginDeferWindowPos
ShowWindow
LoadStringW
LoadAcceleratorsW
GetWindowPlacement
RegisterClassExW
SetWindowTextW
ScreenToClient
DeleteMenu
CreateWindowExW
GetDpiForWindow
InsertMenuItemW
GetMenu
GetMenuItemID
PostMessageW
GetMenuItemInfoW
DeferWindowPos
GetMessageW
GetClientRect
CharNextW
SetCursorPos
CreateDialogParamW
CheckDlgButton
IntersectRect
GetMessagePos
ModifyMenuW
DrawAnimatedRects
SetForegroundWindow
FindWindowW
BringWindowToTop
GetLastActivePopup
PeekMessageW
IsDialogMessageW
GetWindow
CharUpperBuffW
IsCharAlphaNumericW
CharUpperW
GetWindowRect
GetDC
SetWindowPos
HideCaret
EndDialog
GetSystemMetrics
MessageBeep
SetCaretPos
GetSubMenu
OpenClipboard
SetTimer
CloseClipboard
EmptyClipboard
CreateCaret
SetDlgItemTextW
MapWindowPoints
SendDlgItemMessageW
MoveWindow
DestroyMenu
EnableWindow
GetWindowTextLengthW
CallWindowProcW
GetDlgItemInt
CheckRadioButton
SendMessageW
GetDlgItemTextW
IsDlgButtonChecked
SetFocus
GetClipboardData
ScrollWindowEx
LoadCursorW
DestroyCaret
SetCapture
SetClipboardData
SetWindowLongW
TrackPopupMenuEx
GetDlgItem
GetParent
GetWindowTextW
GetWindowLongW
SetScrollInfo
RegisterClipboardFormatW
DefWindowProcW
GetKeyState
DestroyWindow
IsClipboardFormatAvailable
ShowCaret
KillTimer
EnableMenuItem
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
CharLowerW
ShowCursor
RegisterClassW

msvcrt

_unlock
_lock
__CxxFrameHandler3
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_onexit
__p__commode
_XcptFilter
iswprint
memcpy
_except_handler4_common
_vsnwprintf
atoi
memcpy_s
_purecall
wcschr
isspace
_wcsnicmp
wcsrchr
wcsncmp
_resetstkoflw
?terminate@@YAXXZ
_controlfp
memset
__dllonexit
memmove
_amsg_exit

api-ms-win-core-path-l1-1-0

PathCchAddBackslash
PathCchCombine

shlwapi

StrChrW
StrRChrW
ord388
ord219
StrToIntW
StrChrIW
StrStrIW

comctl32

ImageList_ReplaceIcon
ord410
ord413
ImageList_SetBkColor
ord337
ord236
InitCommonControlsEx
ord384
ImageList_Create
ord4
ImageList_Destroy
ord340
ord2
ord329
ord334
ord338

comdlg32

GetOpenFileNameW
GetSaveFileNameW
ChooseFontW
PrintDlgExW

shell32

DragFinish
DragQueryFileW
SHGetStockIconInfo
ord6
ShellAboutW

authz

AuthzInitializeContextFromSid
AuthzFreeContext
AuthzFreeResourceManager
AuthzAccessCheck
AuthzInitializeResourceManager

aclui

ord2

ole32

CoTaskMemFree
CoInitializeEx
ReleaseStgMedium
CoUninitialize
CoCreateInstance
CoTaskMemAlloc

ulib

?SPrintfAppend@DSTRING@@UAAEPBGZZ
?NewBuf@DSTRING@@UAEEK@Z
?Resize@DSTRING@@UAEEK@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
??0DSTRING@@QAE@XZ
??1DSTRING@@UAE@XZ
?SPrintf@DSTRING@@UAAEPBGZZ
?Compare@OBJECT@@UBEJPBV1@@Z
??1OBJECT@@UAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
??0OBJECT@@IAE@XZ
??0ARRAY@@QAE@XZ
?DebugDump@OBJECT@@UBEXE@Z

clb

ClbSetColumnWidths
ClbAddData

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlCreateUnicodeString
RtlInitUnicodeString
RtlFreeUnicodeString
RtlIoDecodeMemIoResource
RtlCmDecodeMemIoResource

uxtheme

SetWindowTheme

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6e1b8202aded47b7c2380a87886d20c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

api-ms-win-core-path-l1-1-0

shlwapi

comctl32

comdlg32

shell32

authz

aclui

ole32

ulib

clb

ntdll

uxtheme

Sections

.text Size: 113KB - Virtual size: 113KB

.data Size: 512B - Virtual size: 264KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 187KB - Virtual size: 186KB

.reloc Size: 149KB - Virtual size: 148KB

.text
Size: 113KB - Virtual size: 113KB

.data
Size: 512B - Virtual size: 264KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 187KB - Virtual size: 186KB

.reloc
Size: 149KB - Virtual size: 148KB