0465f180fc2b0d21daedfc46299cc22ee95949ca5028f1d5db422640f8fdceaf

Sharing

Copy URL

Twitter E-mail

General

Target

0465f180fc2b0d21daedfc46299cc22ee95949ca5028f1d5db422640f8fdceaf
Size

466KB
MD5

2ee5cdca33113ccab92450bba621727e
SHA1

93b56d59e70ed4b6a0eb16da9e1626e11f24e8e9
SHA256

0465f180fc2b0d21daedfc46299cc22ee95949ca5028f1d5db422640f8fdceaf
SHA512

966b45fd7e2b4e25d2470332df4dbe7e6965dc49d6a2aba41d1ccbfacb778c2813929c6884f225278148a180bdb23a6d3da5b38bdf21c479dbb53f02caec3fb1
SSDEEP

12288:sD7hnPSkYwX5+QRZ66z24VZbdrpgrXN2LWzmidNswk1sR:s/dQwX5+6Z66z24VZbFpgJ2LWzmidNs0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0465f180fc2b0d21daedfc46299cc22ee95949ca5028f1d5db422640f8fdceaf

Files

0465f180fc2b0d21daedfc46299cc22ee95949ca5028f1d5db422640f8fdceaf
.exe windows:10 windows x86 arch:x86

e38ac1f1bfcdcc722d22cc5e0517d9b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

regedit.pdb

Imports

advapi32

RegOpenKeyW
RegDeleteValueW
RegCreateKeyW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegEnumKeyW
RegLoadKeyW
RegUnLoadKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegRenameKey
GetSecurityInfo
RegQueryValueExW
OpenProcessToken
RegSetKeySecurity
GetSecurityDescriptorControl
AdjustTokenPrivileges
LookupPrivilegeValueW
RegConnectRegistryW
RegEnumValueW
SetSecurityDescriptorGroup
LookupAccountSidW
MapGenericMask
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
SetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegFlushKey
GetSidSubAuthority
GetSecurityDescriptorGroup
GetSidSubAuthorityCount
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegSetValueW
RegRestoreKeyW
RegSetValueExA
RegSaveKeyW
GetInheritanceSourceW
RegCloseKey

kernel32

GetModuleHandleExW
FreeLibrary
GetTimeFormatW
FileTimeToLocalFileTime
LoadLibraryW
FileTimeToSystemTime
lstrcmpW
WideCharToMultiByte
GetFileSize
DeleteFileW
MultiByteToWideChar
CreateFileW
SetFilePointer
WriteFile
SearchPathW
ReadFile
GetCurrentProcess
ExitProcess
HeapSetInformation
GetLongPathNameW
GetCommandLineW
lstrcmpiW
LocalAlloc
IsDebuggerPresent
RegisterApplicationRestart
GetDateFormatW
FormatMessageW
GlobalAlloc
GetProcAddress
GlobalLock
GetModuleHandleW
LocalReAlloc
DebugBreak
GlobalUnlock
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
CompareStringOrdinal
MulDiv
GetProcessHeap
GetCurrentProcessId
GetComputerNameW
LocalFree
CreateMutexExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
GetLastError
HeapAlloc
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
Sleep
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetModuleFileNameA

gdi32

GetStockObject
GetTextExtentPoint32W
StartPage
AbortDoc
EndDoc
DeleteDC
SetViewportOrgEx
SetAbortProc
StartDocW
EndPage
CreatePatternBrush
CreateBitmap
PatBlt
SelectClipRgn
GetObjectW
ExcludeClipRect
SelectObject
GetDeviceCaps
GetTextMetricsW
SetTextColor
SetBkColor
DeleteObject
CreateFontIndirectW
ExtTextOutW

user32

IsIconic
GetDpiForSystem
LoadMenuW
LoadImageW
UpdateWindow
DialogBoxParamW
PostQuitMessage
CheckMenuItem
GetSystemMetricsForDpi
SetCursor
InsertMenuW
EndDeferWindowPos
DrawMenuBar
GetProcessDefaultLayout
LoadIconW
TranslateMessage
TranslateAcceleratorW
GetSysColor
SetThreadDpiAwarenessContext
SetMenuDefaultItem
SetWindowPlacement
SetMenuItemInfoW
ClientToScreen
DestroyIcon
DispatchMessageW
BeginDeferWindowPos
ShowWindow
LoadStringW
LoadAcceleratorsW
GetWindowPlacement
RegisterClassExW
SetWindowTextW
ScreenToClient
DeleteMenu
CreateWindowExW
GetDpiForWindow
InsertMenuItemW
GetMenu
GetMenuItemID
PostMessageW
GetMenuItemInfoW
DeferWindowPos
GetMessageW
GetClientRect
CharNextW
SetCursorPos
CreateDialogParamW
CheckDlgButton
IntersectRect
GetMessagePos
ModifyMenuW
DrawAnimatedRects
SetForegroundWindow
FindWindowW
BringWindowToTop
GetLastActivePopup
PeekMessageW
IsDialogMessageW
GetWindow
CharUpperBuffW
IsCharAlphaNumericW
CharUpperW
GetWindowRect
GetDC
SetWindowPos
HideCaret
EndDialog
GetSystemMetrics
MessageBeep
SetCaretPos
GetSubMenu
OpenClipboard
SetTimer
CloseClipboard
EmptyClipboard
CreateCaret
SetDlgItemTextW
MapWindowPoints
SendDlgItemMessageW
MoveWindow
DestroyMenu
EnableWindow
GetWindowTextLengthW
CallWindowProcW
GetDlgItemInt
CheckRadioButton
SendMessageW
GetDlgItemTextW
IsDlgButtonChecked
SetFocus
GetClipboardData
ScrollWindowEx
LoadCursorW
DestroyCaret
SetCapture
SetClipboardData
SetWindowLongW
TrackPopupMenuEx
GetDlgItem
GetParent
GetWindowTextW
GetWindowLongW
SetScrollInfo
RegisterClipboardFormatW
DefWindowProcW
GetKeyState
DestroyWindow
IsClipboardFormatAvailable
ShowCaret
KillTimer
EnableMenuItem
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
CharLowerW
ShowCursor
RegisterClassW

msvcrt

_unlock
_lock
__CxxFrameHandler3
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_onexit
__p__commode
_XcptFilter
iswprint
memcpy
_except_handler4_common
_vsnwprintf
atoi
memcpy_s
_purecall
wcschr
isspace
_wcsnicmp
wcsrchr
wcsncmp
_resetstkoflw
?terminate@@YAXXZ
_controlfp
memset
__dllonexit
memmove
_amsg_exit

api-ms-win-core-path-l1-1-0

PathCchAddBackslash
PathCchCombine

shlwapi

StrChrW
StrRChrW
ord388
ord219
StrToIntW
StrChrIW
StrStrIW

comctl32

ImageList_ReplaceIcon
ord410
ord413
ImageList_SetBkColor
ord337
ord236
InitCommonControlsEx
ord384
ImageList_Create
ord4
ImageList_Destroy
ord340
ord2
ord329
ord334
ord338

comdlg32

GetOpenFileNameW
GetSaveFileNameW
ChooseFontW
PrintDlgExW

shell32

DragFinish
DragQueryFileW
SHGetStockIconInfo
ord6
ShellAboutW

authz

AuthzInitializeContextFromSid
AuthzFreeContext
AuthzFreeResourceManager
AuthzAccessCheck
AuthzInitializeResourceManager

aclui

ord2

ole32

CoTaskMemFree
CoInitializeEx
ReleaseStgMedium
CoUninitialize
CoCreateInstance
CoTaskMemAlloc

ulib

?SPrintfAppend@DSTRING@@UAAEPBGZZ
?NewBuf@DSTRING@@UAEEK@Z
?Resize@DSTRING@@UAEEK@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
??0DSTRING@@QAE@XZ
??1DSTRING@@UAE@XZ
?SPrintf@DSTRING@@UAAEPBGZZ
?Compare@OBJECT@@UBEJPBV1@@Z
??1OBJECT@@UAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
??0OBJECT@@IAE@XZ
??0ARRAY@@QAE@XZ
?DebugDump@OBJECT@@UBEXE@Z

clb

ClbSetColumnWidths
ClbAddData

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlCreateUnicodeString
RtlInitUnicodeString
RtlFreeUnicodeString
RtlIoDecodeMemIoResource
RtlCmDecodeMemIoResource

uxtheme

SetWindowTheme

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e38ac1f1bfcdcc722d22cc5e0517d9b6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

api-ms-win-core-path-l1-1-0

shlwapi

comctl32

comdlg32

shell32

authz

aclui

ole32

ulib

clb

ntdll

uxtheme

Sections

.text Size: 118KB - Virtual size: 117KB

.data Size: 512B - Virtual size: 264KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 187KB - Virtual size: 186KB

.reloc Size: 149KB - Virtual size: 148KB

.text
Size: 118KB - Virtual size: 117KB

.data
Size: 512B - Virtual size: 264KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 187KB - Virtual size: 186KB

.reloc
Size: 149KB - Virtual size: 148KB