c139be79c878fdd9738b976f77f902d44d14f14957d052c03fef15b787dfb46e

Sharing

Copy URL Twitter E-mail

General

Target

c139be79c878fdd9738b976f77f902d44d14f14957d052c03fef15b787dfb46e
Size

339KB
MD5

30242e882eb6c1d663c2968723506595
SHA1

da390670e6e381cd85c7a76e1037c28b34eea300
SHA256

c139be79c878fdd9738b976f77f902d44d14f14957d052c03fef15b787dfb46e
SHA512

e8c29c0493d82208cef283f54d4ff502d986ebb196c681c8079b66a1eace7a00e50d99f3a1e5bc7127f7cc90a438947886f8f11122c760002d889db1f916bfbc
SSDEEP

6144:Bj4wLUQswSlKZJ1CRObyRuku7ZBTMygcvObKzblZwhRIEzA0wPub5b1zSFCM/cvY:t4SjBZJ1CKEAMygcmbKzblZwhRIEzA0K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c139be79c878fdd9738b976f77f902d44d14f14957d052c03fef15b787dfb46e

Files

c139be79c878fdd9738b976f77f902d44d14f14957d052c03fef15b787dfb46e
.exe windows:6 windows x86 arch:x86

cf1e5a297dfd772e4673a72796faed57

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

docsvw32.pdb

Imports

shlwapi

UrlCreateFromPathW
PathFindFileNameW
SHCreateStreamOnFileW

urlmon

CreateAsyncBindCtx
RegisterBindStatusCallback
IsValidURL
CreateURLMoniker
FindMimeFromData
GetClassFileOrMime
CoInternetCreateSecurityManager

kernel32

OpenProcess
QueryFullProcessImageNameW
GetCurrentThreadId
FreeLibrary
LoadLibraryW
MulDiv
GetTickCount
OpenEventW
WaitForSingleObject
SetEvent
CreateFileW
CreateEventW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalLock
GlobalUnlock
SetDllDirectoryW
ResetEvent
GetLastError
ReadFile
GetPrivateProfileStringW
TerminateProcess
OutputDebugStringW
WriteFile
DeleteFileW
Sleep
lstrlenW
GetFileAttributesW
CopyFileExW
FindFirstFileExW
FindClose
GetShortPathNameW
SetFileAttributesW
GetModuleFileNameW
GetTempPathW
GetSystemTime
FindNextFileW
SetFilePointerEx
FlushFileBuffers
GetCurrentProcessId
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableW
RaiseException
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
ExitProcess
HeapFree
TlsSetValue
HeapAlloc
GetFileType
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCPInfo
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetProcAddress
GetModuleHandleW
CloseHandle
SetLastError
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
HeapSize
HeapReAlloc
GetConsoleOutputCP
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
GetEnvironmentStringsW
GetConsoleMode
DecodePointer
GetCurrentProcess
WriteConsoleW

user32

SetTimer
GetMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
PeekMessageW
SetWindowsHookExW
UnhookWindowsHookEx
RegisterClassExW
PostQuitMessage
SystemParametersInfoW
UpdateLayeredWindow
PostMessageW
SetWindowPos
SendMessageW
MoveWindow
DefWindowProcW
EndPaint
GetSysColorBrush
SetFocus
BeginPaint
SetWindowLongW
CreateWindowExW
UnregisterClassW
RegisterClassW
LoadCursorW
ReleaseDC
GetDC
DestroyWindow
CreateAcceleratorTableW
SetRectEmpty
DestroyAcceleratorTable
GetClientRect
GetWindowRect
GetWindowLongW
GetFocus
IsChild
GetCursorPos
WindowFromPoint
IsWindowEnabled
IsWindowVisible
IsWindow
GetWindow
GetWindowThreadProcessId
GetParent
CopyRect
ShowWindow
RedrawWindow
LoadImageW
FillRect
GetSysColor

gdi32

CreateCompatibleDC
SetLayout
DeleteDC
SelectObject
GetObjectW
CreateDIBSection
GetDeviceCaps
DeleteObject

advapi32

RegGetValueW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetDesktopFolder
GetCurrentProcessExplicitAppUserModelID

ole32

CoFreeLibrary
CoLoadLibrary
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
CLSIDFromString
OleUninitialize
CoDisconnectObject
CoReleaseMarshalData
OleLockRunning
CoMarshalInterface
CreateStreamOnHGlobal
OleInitialize
CoRegisterMessageFilter
CoUninitialize
CoInitialize
CoGetMalloc
CreateBindCtx
CreateFileMoniker
OleDestroyMenuDescriptor
CoCreateInstance
OleRun
GetClassFile
OleGetAutoConvert
GetHGlobalFromStream

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf1e5a297dfd772e4673a72796faed57

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

urlmon

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 170KB - Virtual size: 170KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 7KB - Virtual size: 9KB

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 170KB - Virtual size: 170KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 7KB - Virtual size: 9KB

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 10KB - Virtual size: 10KB