336b785cc95e3a448232b788c3d87ac0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

336b785cc95e3a448232b788c3d87ac0N.exe
Size

6.3MB
MD5

336b785cc95e3a448232b788c3d87ac0
SHA1

0640f7c6f8652782f5984dfb2e472c1f7107a32e
SHA256

d10500a52ca14317d1ecbd733c5ed68ceba81e6a8f585166f46a7149239d8409
SHA512

3524fab819412f5bbf337be3f29c51018f2d2c323b30fb3042ddb0f1eda50053b2d0ab794e7758b5aae6c1d97d53d74d8c6914bf565b97e95a696173aab42203
SSDEEP

196608:sLr+TTlMW7v8crl5pIpmpxSVTgDKl5VJF9LlK/GJXi5l4fm8:0yTTrl4Phl5VJbl2uMl4ft

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
336b785cc95e3a448232b788c3d87ac0N.exe

Files

336b785cc95e3a448232b788c3d87ac0N.exe
.exe windows:6 windows x86 arch:x86

57c8dfcaaeb9800636e955099a8453bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
GetModuleFileNameW
GetFileType
WaitForSingleObject
FlushFileBuffers
MoveFileExW
GetCurrentDirectoryW
GetTickCount
WriteConsoleW
WriteFile
ExitThread
TlsGetValue
GetProcessHeap
FindClose
ReadFile
LoadLibraryA
GetSystemDirectoryA
InitializeCriticalSectionAndSpinCount
ReadConsoleW
HeapSize
SleepEx
GetSystemTimeAsFileTime
InitializeCriticalSection
SetEnvironmentVariableW
CloseHandle
MoveFileExA
FindFirstFileExW
GetEnvironmentStringsW
RaiseException
TlsFree
DeleteFileW
SetEndOfFile
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleExW
SetLastError
TlsSetValue
GetConsoleMode
GetModuleHandleW
TlsAlloc
SetFilePointerEx
GetProcAddress
WideCharToMultiByte
TerminateProcess
GetFileSizeEx
HeapAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
GetCurrentProcess
GetFileAttributesExW
DecodePointer
FreeLibraryAndExitThread
FormatMessageA
ExitProcess
SetStdHandle
GetEnvironmentVariableA
IsProcessorFeaturePresent
LoadLibraryExW
GetModuleHandleA
GetFileInformationByHandle
GetConsoleOutputCP
WaitForMultipleObjects
IsValidCodePage
FileTimeToSystemTime
FreeLibrary
IsDebuggerPresent
EnterCriticalSection
CompareStringW
GetLastError
CreateFileA
DeleteCriticalSection
LCMapStringW
GetFullPathNameW
GetStartupInfoW
GetVersionExA
FindNextFileW
GetDriveTypeW
GetTimeZoneInformation
HeapReAlloc
GetCPInfo
GetACP
PeekNamedPipe
FreeEnvironmentStringsW
GetCurrentProcessId
GetOEMCP
EncodePointer
GetStdHandle
GetCommandLineW
UnhandledExceptionFilter
RtlUnwind
MultiByteToWideChar
Sleep
GetFileSize
CreateFileW
HeapFree
CreateThread
GetCommandLineA
SystemTimeToTzSpecificLocalTime
GetStringTypeW

user32

CreateWindowExW
TranslateMessage
SetWindowPos
GetWindowRect
DefWindowProcW
PostQuitMessage
MessageBoxW
DrawTextW
FillRect
LoadIconW
ShowWindow
GetMessageW
UpdateWindow
RegisterClassExW
RedrawWindow
GetSystemMetrics
GetClientRect
PostMessageW
DispatchMessageW
BeginPaint
EndPaint

gdi32

SetTextColor
SetBkMode
CreateSolidBrush
DeleteObject

advapi32

CryptReleaseContext
CryptGetHashParam
CryptDestroyKey
CryptCreateHash
CryptAcquireContextA
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptDestroyHash
CryptHashData
RegEnumKeyExA

crypt32

CryptDecodeObjectEx
CertGetCertificateChain
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertCloseStore
CertEnumCertificatesInStore
CertFindExtension
CryptStringToBinaryA
CertFreeCertificateChain
CryptQueryObject
CertFindCertificateInStore
PFXImportCertStore
CertFreeCertificateContext
CertOpenStore

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord45
ord60
ord22
ord211
ord50
ord143
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
listen
sendto
recvfrom
select
__WSAFDIsSet
gethostname
ntohl
ioctlsocket

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57c8dfcaaeb9800636e955099a8453bf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.rdata Size: 135KB - Virtual size: 135KB

.data Size: 44KB - Virtual size: 58KB

.rsrc Size: 68KB - Virtual size: 67KB

.reloc Size: 74KB - Virtual size: 73KB

.text
Size: 5.8MB - Virtual size: 5.8MB

.rdata
Size: 135KB - Virtual size: 135KB

.data
Size: 44KB - Virtual size: 58KB

.rsrc
Size: 68KB - Virtual size: 67KB

.reloc
Size: 74KB - Virtual size: 73KB