cedf935ca1ba1219b74cdfa11546b99e1ca76970ccff2c1c71c7bf5e178ec711

Sharing

Copy URL Twitter E-mail

General

Target

cedf935ca1ba1219b74cdfa11546b99e1ca76970ccff2c1c71c7bf5e178ec711
Size

329KB
MD5

f3d9ac909310b58205a8a159bba8d900
SHA1

f8c0cdce46e9e3eecbd001ea33c3b6dcc9148a4a
SHA256

cedf935ca1ba1219b74cdfa11546b99e1ca76970ccff2c1c71c7bf5e178ec711
SHA512

279431a72eec7d729f6364d9897aba2df36f9d6618351bc50377ec42c9354b9b1beef230eedf9acaa8964835ef5ee098d1cca5c635dc18f445a246f41d5c2f65
SSDEEP

6144:Z4INa0Ub3kMX87dbKf11XHXnkrYIpF+XBLMJk4+O7MQNh0AaW8pv:ZLN8UMA+Nnk8ykvrQJr8pv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cedf935ca1ba1219b74cdfa11546b99e1ca76970ccff2c1c71c7bf5e178ec711

Files

cedf935ca1ba1219b74cdfa11546b99e1ca76970ccff2c1c71c7bf5e178ec711
.exe windows:5 windows x86 arch:x86

4efbd25063b648d3c8660fec527d2518

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord70
ord205

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData

kernel32

GetUserDefaultUILanguage
GetLastError
GetLocaleInfoW
EnumResourceLanguagesW
CreateFileW
WriteFile
CloseHandle
GetTempPathW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
DeleteFileW
RaiseException
lstrcmpiW
RemoveDirectoryW
MulDiv
GetVersionExW
CompareStringW
lstrlenW
WaitForSingleObject
lstrcpynW
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
FindNextFileW
CreateDirectoryW
GetCurrentThreadId
DecodePointer
GetCommandLineW
LCMapStringW
GetStringTypeW
GetModuleFileNameW
GetStdHandle
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetProcessHeap
HeapAlloc
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
HeapFree
SetStdHandle
GetConsoleCP
GetCommandLineA
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetACP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
GetFileType
WriteConsoleW

user32

SetCapture
GetCapture
ReleaseCapture
GetDlgCtrlID
GetCursorPos
PtInRect
TrackMouseEvent
SetCursor
DrawFocusRect
GetFocus
GetSysColor
SetFocus
UpdateWindow
InvalidateRect
CallWindowProcW
DefWindowProcW
CharLowerBuffW
DialogBoxParamW
UnregisterClassW
DestroyWindow
GetActiveWindow
MessageBoxW
LoadBitmapW
GetClassNameW
LoadCursorW
SystemParametersInfoW
CreateWindowExW
CharNextW
SetWindowLongW
EndDialog
EndPaint
BeginPaint
IsWindowVisible
RedrawWindow
EnableWindow
ShowWindow
SetDlgItemTextW
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
GetClientRect
GetWindowLongW
DrawTextW
OffsetRect
IsWindow
GetParent
ScreenToClient
GetWindowRect
GetDC
ReleaseDC
LoadIconW
SendMessageW
GetDlgItem
IsWindowEnabled
PostMessageW
MessageBoxIndirectW
FillRect
SetRectEmpty

gdi32

StretchBlt
DeleteObject
GetStockObject
SelectObject
SetStretchBltMode
GetDeviceCaps
CreateFontIndirectW
GetObjectW
DeleteDC
SetTextColor
CreateCompatibleDC
SetBkMode

advapi32

RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW

shell32

CommandLineToArgvW
SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW

ole32

CoTaskMemAlloc
CoCreateInstance
CoCreateGuid
StringFromCLSID
CoTaskMemRealloc
CoTaskMemFree
CoInitializeEx

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW

comctl32

InitCommonControlsEx

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4efbd25063b648d3c8660fec527d2518

Headers

DLL Characteristics

File Characteristics

Imports

msi

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

Sections

.text Size: 103KB - Virtual size: 103KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 176KB - Virtual size: 175KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 103KB - Virtual size: 103KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 176KB - Virtual size: 175KB

.reloc
Size: 7KB - Virtual size: 6KB