303e5b9a523457d862e09ba53701c2c0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

303e5b9a523457d862e09ba53701c2c0N.exe
Size

5.1MB
MD5

303e5b9a523457d862e09ba53701c2c0
SHA1

e4ea0b7a2782743be9f632c82f1126878e0f2749
SHA256

9c2d3c17618f0a5784c3f78d3ee36bc8d100bf462862836c767201d15f1912d8
SHA512

ab638e3a669629cf1c59e7b77c682f0096a31d7e4912795e072471398addd845ee5ac8b6059737d81b397cda157c0883ba12450a44bcc2aecffb9f8b5dcfd4da
SSDEEP

98304:wVzhHdFZXYBrcWe8qkHFXi+CCCyKySaxQNI0z9IKdvFvbCyNPIIjX5PVwt5WGqsP:QHOr2+CCCyKySaxQN7P4WG/ZHk2lW2aS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
303e5b9a523457d862e09ba53701c2c0N.exe

Files

303e5b9a523457d862e09ba53701c2c0N.exe
.exe windows:4 windows x86 arch:x86

bb173fe537404f2f82ddf8cb501ef6a5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
MoveFileW
GetCurrentThreadId
WaitForMultipleObjects
CloseHandle
CompareStringW
TlsSetValue
GetStringTypeW
VirtualFree
EnterCriticalSection
FreeEnvironmentStringsA
FileTimeToLocalFileTime
GetDriveTypeA
QueryPerformanceFrequency
HeapAlloc
LeaveCriticalSection
GetFileSize
LoadLibraryA
GetEnvironmentStrings
TerminateProcess
GetProcAddress
MoveFileExA
FindFirstFileA
TlsGetValue
DeleteCriticalSection
HeapDestroy
RtlUnwind
LCMapStringA
WideCharToMultiByte
CreateThread
GetFullPathNameA
GetTickCount
SetLastError
GetFileInformationByHandle
GetACP
HeapReAlloc
SleepEx
InitializeCriticalSection
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
GetStringTypeA
WriteFile
GetModuleFileNameW
TlsAlloc
GetEnvironmentVariableA
GetCurrentProcess
GetLastError
GetStartupInfoW
SetEnvironmentVariableA
SetEndOfFile
FreeEnvironmentStringsW
GetModuleHandleW
GetFileType
SetFilePointer
GetCurrentDirectoryA
SetHandleCount
InterlockedIncrement
GetCommandLineW
HeapFree
ExitProcess
FlushFileBuffers
GetFileSizeEx
GetVersionExA
QueryPerformanceCounter
FileTimeToSystemTime
GetCurrentProcessId
GetStdHandle
WaitForSingleObject
CompareStringA
FormatMessageA
GetSystemDirectoryA
FreeLibrary
PeekNamedPipe
LCMapStringW
GetModuleHandleA
GetSystemTime
HeapCreate
Sleep
SetStdHandle
GetLocalTime
GetCommandLineA
CreateFileA
VirtualAlloc
FindClose
MultiByteToWideChar
ExitThread
InterlockedDecrement
GetStartupInfoA
GetFileAttributesA
GetModuleFileNameA
UnhandledExceptionFilter
GetProcessHeap
DeleteFileA
ReadFile
GetCurrentThread
GetTimeZoneInformation

user32

GetWindowRect
PostQuitMessage
GetClientRect
GetSystemMetrics
BeginPaint
DefWindowProcW
UpdateWindow
CreateWindowExW
LoadIconW
EndPaint
MessageBoxA
SetWindowPos
ShowWindow
FillRect
PostMessageW
SendMessageA
GetMessageW
RegisterClassExW
RedrawWindow
DrawTextW
DispatchMessageW
TranslateMessage

gdi32

CreateSolidBrush
DeleteObject
SetTextColor
SetBkMode

advapi32

CryptImportKey
CryptDestroyHash
CryptReleaseContext
CryptEncrypt
CloseServiceHandle
CryptDestroyKey
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA

crypt32

CertFreeCertificateContext
CertGetCertificateChain
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CryptStringToBinaryA
CertFindCertificateInStore
CryptQueryObject
PFXImportCertStore
CertFreeCertificateChainEngine
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertFindExtension

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord45
ord60
ord22
ord211
ord26
ord143
ord50
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohl
listen

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb173fe537404f2f82ddf8cb501ef6a5

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 204KB - Virtual size: 201KB

.data Size: 56KB - Virtual size: 75KB

.rsrc Size: 68KB - Virtual size: 68KB

.reloc Size: 52KB - Virtual size: 49KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 204KB - Virtual size: 201KB

.data
Size: 56KB - Virtual size: 75KB

.rsrc
Size: 68KB - Virtual size: 68KB

.reloc
Size: 52KB - Virtual size: 49KB