2Take1Menu_660103[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2Take1Menu_660103.exe
Size

18.6MB
MD5

f01e065a25cd4a89a681c06db972f296
SHA1

9212ad209deb349a2a55f020e9065d97ed46922d
SHA256

cec6dcf48677c1b3d5cac1bb8843876052be81a74d8b14d72d22847bac17dded
SHA512

8d8a9956b7c027026bc3a0c4d45ef87e2192a4de70732e5eddc799915e3b3805e3c2ea1d7810bf0073b8feb82628c9afe3fb8217ab03df32219113fd5b06c6d8
SSDEEP

393216:LZZZMBYP1ov7MPjit1K3QYDez3QzCQSPIaXSz69II65rUVK:z1ov7MPjifK3ivhdS+9Ix5rUVK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2Take1Menu_660103.exe

Files

2Take1Menu_660103.exe
.exe windows:6 windows x86 arch:x86

63a5778a34f0b6ebc466975d817d2376

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

kernel32

CreateEventA
FormatMessageA
CloseHandle
GetSystemTimeAsFileTime
WaitForMultipleObjects
GetCurrentProcess
LoadLibraryExW
WaitForSingleObjectEx
LCMapStringEx
FormatMessageW
SetFilePointer
FindFirstFileExA
WideCharToMultiByte
GetModuleHandleExW
ExitProcess
CreateSemaphoreA
FileTimeToSystemTime
SetEvent
GetSystemDirectoryW
GetProcAddress
GetLocaleInfoEx
SetEndOfFile
DeleteFileA
EncodePointer
LoadLibraryA
HeapSize
TerminateProcess
GlobalMemoryStatus
InitializeCriticalSectionEx
MultiByteToWideChar
LCMapStringW
FlushFileBuffers
GetVersion
GetTickCount64
GetUserDefaultLCID
ExitThread
WriteConsoleW
SetFileTime
CreateFileA
GetProcessAffinityMask
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
IsDebuggerPresent
LeaveCriticalSection
GetVersionExA
GetEnvironmentVariableA
GetCurrentProcessId
GetFileAttributesExW
GetFileSize
GetCurrentDirectoryW
WaitForSingleObject
GetStartupInfoW
QueryPerformanceFrequency
FindFirstFileW
SetCurrentDirectoryA
GetFileSizeEx
GetCPInfo
UnhandledExceptionFilter
FindNextFileW
CreateThread
GetDateFormatW
TlsGetValue
GetModuleHandleA
GetFinalPathNameByHandleW
GetModuleFileNameA
GetFileType
SetFilePointerEx
ReleaseSRWLockExclusive
SetFileAttributesA
GetFullPathNameW
SetCurrentDirectoryW
CreateDirectoryA
GetDriveTypeW
SetUnhandledExceptionFilter
GetFileInformationByHandle
CompareStringW
SetEnvironmentVariableA
GetConsoleMode
GetProcessHeap
CreateFileW
EnterCriticalSection
GetTickCount
GetCurrentDirectoryA
IsValidLocale
RemoveDirectoryA
GetEnvironmentStringsW
GetTimeZoneInformation
lstrlenA
PeekNamedPipe
FreeLibraryAndExitThread
HeapFree
GetModuleHandleW
SleepEx
GetFileAttributesA
TlsSetValue
AreFileApisANSI
InitializeCriticalSection
ReleaseSemaphore
RtlUnwind
SetLastError
GetCurrentThreadId
SetFileAttributesW
DecodePointer
LocalFree
GetFileAttributesW
GetOEMCP
VirtualFree
GetLastError
HeapReAlloc
SetStdHandle
SystemTimeToTzSpecificLocalTime
GetTempPathW
RemoveDirectoryW
MoveFileExW
GetCommandLineW
GetModuleFileNameW
VerifyVersionInfoW
EnumSystemLocalesW
GetStringTypeW
IsValidCodePage
GetACP
WriteFile
InitializeSListHead
FindFirstFileA
HeapAlloc
FreeEnvironmentStringsW
DeleteCriticalSection
TryAcquireSRWLockExclusive
GetSystemInfo
GetConsoleCP
DeleteFileW
lstrcatA
CreateDirectoryW
ReadFile
IsProcessorFeaturePresent
TlsFree
FindNextFileA
GetTimeFormatW
WakeAllConditionVariable
ReadConsoleW
QueryPerformanceCounter
ResetEvent
VirtualAlloc
Sleep
TlsAlloc
GetCommandLineA
AcquireSRWLockExclusive
LoadLibraryW
FindClose
VerSetConditionMask
GetStdHandle
GetTempPathA
FreeLibrary
RaiseException

user32

SetWindowTextW
MessageBoxA
GetDlgItem
wsprintfA
LoadStringW
SendMessageA
ShowWindow
SetWindowLongA
MessageBoxW
DialogBoxParamW
CharUpperW
LoadStringA
KillTimer
CharUpperA
SetWindowTextA
DialogBoxParamA
DestroyWindow
SetTimer
LoadIconA
GetWindowLongA
PostMessageA
EndDialog

shell32

ShellExecuteExA

oleaut32

VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

advapi32

CryptReleaseContext
CryptHashData
CryptEncrypt
CryptCreateHash
CryptImportKey
CryptAcquireContextW
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash

crypt32

CryptDecodeObjectEx
CertOpenStore
CertGetNameStringW
CryptQueryObject
CertGetCertificateChain
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CryptStringToBinaryW
CertCloseStore
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFindExtension
PFXImportCertStore

wldap32

ord216
ord301
ord145
ord219
ord46
ord14
ord147
ord73
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133

ws2_32

gethostname
htons
getsockopt
send
WSAWaitForMultipleEvents
WSACreateEvent
WSAEnumNetworkEvents
WSACloseEvent
freeaddrinfo
getaddrinfo
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
ioctlsocket
setsockopt
WSAIoctl
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
socket
WSAResetEvent
WSAEventSelect
recvfrom
sendto
getpeername

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63a5778a34f0b6ebc466975d817d2376

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

shell32

oleaut32

bcrypt

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 201KB - Virtual size: 200KB

.data Size: 7KB - Virtual size: 19KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 71KB - Virtual size: 71KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 201KB - Virtual size: 200KB

.data
Size: 7KB - Virtual size: 19KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 71KB - Virtual size: 71KB