3fcf907314f1ac7b2e4e564a1783306d6e4356c15e2dcaf193cbc5bacd4356a1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3fcf907314f1ac7b2e4e564a1783306d6e4356c15e2dcaf193cbc5bacd4356a1.exe
Size

5.7MB
MD5

94048307163c44f9bf90d97a66bbb971
SHA1

f1ee4726bbb346021ecd77c78ceece71b3eef876
SHA256

3fcf907314f1ac7b2e4e564a1783306d6e4356c15e2dcaf193cbc5bacd4356a1
SHA512

f11d52a28217b8926dbfdb190056a8d8a7b61728ae42dd6a998d422a5b6acfa516a9adb2e6ca5dda1a1950a2d8d55d4f1678bf75c071a5bf4fda80c5045db4d9
SSDEEP

98304:7rIQEk/FAEsjtu+AGTF5QDWqnX0XTNnG1gVwrrz0i5HXs4kq10xVTb44ec7Ozr0:v7dBizNxWqqnQTcwy30i9Pb0xVT0Q7Mw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fcf907314f1ac7b2e4e564a1783306d6e4356c15e2dcaf193cbc5bacd4356a1.exe

Files

3fcf907314f1ac7b2e4e564a1783306d6e4356c15e2dcaf193cbc5bacd4356a1.exe
.exe windows:6 windows x86 arch:x86

4a1016ca782fc6652cdb42fa414cea03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentVariableA
GetDiskFreeSpaceA
GetTempPathA
GetCurrentProcess
OpenProcess
GetModuleFileNameA
VerifyVersionInfoW
MultiByteToWideChar
GetCurrentDirectoryA
LocalFileTimeToFileTime
SetFileTime
SystemTimeToFileTime
WriteConsoleW
CreateFileW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetProcessHeap
VerSetConditionMask
WriteFile
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
LCMapStringW
GetFileType
HeapAlloc
HeapFree
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
TlsFree
GetWindowsDirectoryA
GetSystemDirectoryA
CopyFileA
FindResourceA
SizeofResource
LockResource
LoadResource
FreeEnvironmentStringsW
GetLastError
SetFilePointer
ReadFile
GetFileSize
GetFileAttributesExA
CreateDirectoryA
CreateFileA
MoveFileExA
GetProcAddress
GetModuleHandleA
CreateProcessA
GetExitCodeProcess
TerminateProcess
DeleteFileA
Sleep
CloseHandle
RemoveDirectoryA
GetFileAttributesA
FindNextFileA
FindFirstFileA
FindClose
GetEnvironmentStringsW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetLastError
RaiseException
RtlUnwind
LocalFree
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

ShowWindow
CallWindowProcA
wsprintfA
SetProcessDPIAware
GetWindowThreadProcessId
GetClassNameA
EnumWindows
FindWindowExA
FindWindowA
DialogBoxParamA
MonitorFromWindow
SystemParametersInfoA
DrawIconEx
LoadImageA
EnumChildWindows
SetClassLongA
GetDlgItem
MessageBoxA
GetWindowTextA
SetWindowTextA
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
SendDlgItemMessageA
SetDlgItemTextA
EndDialog
CreateDialogParamA
PostMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
LoadStringA
SendMessageA
LoadCursorA
SetWindowLongA
GetWindowLongA
FillRect
DrawFocusRect
SetCursor
GetClientRect
InvalidateRect
EndPaint
BeginPaint
DrawTextA
GetFocus
SetFocus
GetDlgItemTextA

gdi32

DeleteObject
CreateSolidBrush
CreateFontA
CreateFontIndirectA
SetTextColor
SetBkMode
SelectObject
GetDeviceCaps

advapi32

ControlService
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
OpenProcessToken
OpenServiceA
OpenSCManagerA
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
LookupAccountSidW
FreeSid
AllocateAndInitializeSid

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
ord680
SHFileOperationA
ShellExecuteA
SHGetMalloc
SHGetSpecialFolderLocation
SHChangeNotify

ole32

CoInitializeSecurity
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

shlwapi

PathIsRelativeA
SHDeleteKeyA
PathIsNetworkPathA

Sections

.text
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a1016ca782fc6652cdb42fa414cea03

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 146KB - Virtual size: 145KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 3KB - Virtual size: 14KB

.rsrc Size: 5.5MB - Virtual size: 5.5MB

.text
Size: 146KB - Virtual size: 145KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 3KB - Virtual size: 14KB

.rsrc
Size: 5.5MB - Virtual size: 5.5MB