c40495f44123fa3890a8d2e391b65550N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

c40495f44123fa3890a8d2e391b65550N.exe
Size

279KB
MD5

c40495f44123fa3890a8d2e391b65550
SHA1

3bbe4f0fa36c8628b3115c5e67cfe9ed4c340192
SHA256

4d97abf35649a73f2212058a105d7b68780a8b022330e1da5acda9fb7aaa1a1e
SHA512

2463cf8552f3a6fb167302dba7f541c765dbf019e80f66443b34e5817f2850fe14c266a5ae32adc0b36b13139dc8fe7846ac728c89304480ac403c2f2dfeba96
SSDEEP

6144:WE0WDqLs7R+Rd/C7wglrhCBrASuKFR7RxHN:YWmAl+R58xphCBUC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c40495f44123fa3890a8d2e391b65550N.exe

Files

c40495f44123fa3890a8d2e391b65550N.exe
.dll windows:5 windows x64 arch:x64

7fa3047a578280ed24a7ccfbbd78e54a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

iphlpapi

IcmpCloseHandle
IcmpSendEcho2
GetAdaptersAddresses
IcmpCreateFile
GetIpAddrTable

kernel32

lstrlenA
HeapFree
HeapAlloc
FlsSetValue
GetCommandLineA
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
RaiseException
RtlPcToFileHeader
HeapSize
HeapQueryInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSetInformation
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
TerminateThread
SuspendThread
WaitForSingleObject
CreateThread
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
Sleep
ResumeThread
OutputDebugStringA
FreeLibrary
GetProcAddress
LoadLibraryW
GetLastError
GetModuleHandleW
GlobalAlloc
lstrcmpW
GlobalLock
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
lstrcmpA
GetModuleFileNameW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
GetVersionExA
FormatMessageW
GlobalFlags
WritePrivateProfileStringW
SetErrorMode
TlsFree
GlobalFree
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalUnlock
GlobalReAlloc
TlsAlloc
TlsGetValue
LocalFree
LocalAlloc
lstrlenW
GetCurrentProcessId
SetLastError
GetConsoleCP

user32

DestroyMenu
LoadCursorW
GetSysColorBrush
ShowWindow
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongPtrW
SetPropW
GetPropW
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
DefWindowProcW
CallWindowProcW
CopyRect
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetMenuItemID
GetSubMenu
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
GetWindowTextW
SetWindowTextW
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetMenuItemCount
UnregisterClassW
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
SendMessageW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageW
PostQuitMessage
GetMenu

gdi32

SetMapMode
GetClipBox
DeleteObject
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
DeleteDC
GetStockObject
GetDeviceCaps
ScaleWindowExtEx
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegSetValueExW
RegCreateKeyExW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueW

shlwapi

PathFindFileNameW
PathFindExtensionW

oleaut32

VariantClear
VariantChangeType
VariantInit

ws2_32

WSASetLastError
WSACreateEvent
WSACloseEvent
htonl
WSARecvFrom
WSAWaitForMultipleEvents
WSAGetOverlappedResult
recv
setsockopt
WSAGetLastError
WSASocketW
freeaddrinfo
recvfrom
send
closesocket
connect
socket
WSACleanup
getaddrinfo
WSAStartup
sendto
bind
inet_addr
htons

Exports

Exports

?BuildGetRequestFor@@YAHHQEAPEADPEADPEAE@Z
?BuildSingleGetRequestFor@@YAHPEAD0PEAE@Z
?DecodeStatusFromDeviceID@@YAHPEADPEAUPRINTER_STATUS@@@Z
?LPFNPARSESNMPGETREQUEST@@3P6AHPEAEHPEAHPEAD000P6AH0H@Z@ZEA
?LPFNPARSESNMPRESPONSE@@3P6AHPEAEHPEAHPEAD000P6AH0HE0H@Z@ZEA
BuildSetRequestFor
FindJade
FindSnmpAgent
FindSnmpAgentEx
FindSnmpAgentExV6
FindSnmpAgentV6
GetModelName
GetRemotePhysAddress
IpAddrV6Cmp
IsIPv6Enabled
IsNetworkConnected
IsValidIpAddrV6
NetworkClose
NetworkConnect
NetworkConnectNonBlock
NetworkRead
NetworkReadStatus
NetworkReadStatusEx
NetworkReadStatusV2
NetworkWrite
PingV4
SNMPGetOperation
SNMPGetV4
SNMPGetV6
SNMPSetOperation
parseSnmpGetRequest
parseSnmpResponse

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fa3047a578280ed24a7ccfbbd78e54a

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

ws2_32

Exports

Exports

Sections

.text Size: 191KB - Virtual size: 190KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 10KB - Virtual size: 41KB

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 191KB - Virtual size: 190KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 10KB - Virtual size: 41KB

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB