a5adc36b0a9df94a237b86770425fdc73b2d6e64829e045e17e9e6326c2159b3

Sharing

Copy URL Twitter E-mail

General

Target

a5adc36b0a9df94a237b86770425fdc73b2d6e64829e045e17e9e6326c2159b3
Size

1.0MB
MD5

d0c67cb855ddc431b556ddc466bd697d
SHA1

df252311c788be03fc4bf73f0834903aaa9d99f1
SHA256

a5adc36b0a9df94a237b86770425fdc73b2d6e64829e045e17e9e6326c2159b3
SHA512

b5275d7e60bea64b62f9fc75599da47412ccf93fe81555338b6f36301b6c7d0e28b6b1850b1af6b34673d99b1f7da2986cf0a072ec8f9e9997dcda663928baf2
SSDEEP

12288:vqn6kMDxzxgw5FfLu0ZZsuhSYOpwMlM3JgLXIbR1kQ4+SyGj0kkutg:v+6bDxzTvfLXOpD7Il6gO0lut

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5adc36b0a9df94a237b86770425fdc73b2d6e64829e045e17e9e6326c2159b3

Files

a5adc36b0a9df94a237b86770425fdc73b2d6e64829e045e17e9e6326c2159b3
.exe windows:6 windows x86 arch:x86

7faf18cfe07a252c2dc8cf04b99d54c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mstsc.pdb

Imports

advapi32

TraceMessage
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetValueExA
CredGetSessionTypes
CredWriteW
CredReadW
CredUnmarshalCredentialW
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
CredWriteDomainCredentialsW
CredReadDomainCredentialsW
GetUserNameA
CredDeleteW
CredFree

kernel32

GetUserDefaultUILanguage
GetSystemDefaultUILanguage
UnmapViewOfFile
GetLocaleInfoW
CreateFileMappingW
MapViewOfFile
FindResourceExW
RaiseException
GetTimeFormatW
GetDateFormatW
InitializeCriticalSection
DeleteCriticalSection
HeapSetInformation
Sleep
ExpandEnvironmentStringsW
CreateProcessW
VerSetConditionMask
VerifyVersionInfoW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
FindClose
GetTempPathW
SetFilePointer
GetACP
SetLastError
GetFullPathNameW
GetFileAttributesW
lstrcmpW
CompareStringW
LocalAlloc
LocalFree
GetCurrentDirectoryW
GetVersionExW
CreateDirectoryW
FormatMessageW
SearchPathW
GetStartupInfoA
DebugBreak
lstrlenW
GetLocalTime
TlsAlloc
TlsFree
LockResource
SystemTimeToFileTime
WriteFile
GetSystemTime
LoadLibraryA
ExpandEnvironmentStringsA
DeviceIoControl
HeapAlloc
GetProcessHeap
HeapFree
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
GetVersion
WideCharToMultiByte
InterlockedExchange
GetCurrentProcessId
GetCommandLineW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
SetEvent
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
CreateEventW
CreateThread
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
GetProcAddress
LoadLibraryW
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetVersionExA
InterlockedCompareExchange
DeleteFileW
CreateFileW
GetFileSize
ReadFile
LeaveCriticalSection
CloseHandle
GetLastError
EnterCriticalSection

gdi32

DeleteObject
SetRectRgn
GetDCOrgEx
GetClipBox
CombineRgn
EqualRgn
RealizePalette
SelectPalette
GetObjectW
GetStockObject
GetDeviceCaps
SelectObject
CreateCompatibleDC
UpdateColors
DeleteDC
BitBlt
CreateFontIndirectW
TranslateCharsetInfo
SetMapMode
SetBkMode
SetTextColor
StretchBlt
CreateCompatibleBitmap
GetDIBColorTable
CreatePalette
CreateRectRgnIndirect
CreateRectRgn

user32

SetDlgItemTextW
GetDlgItem
SetFocus
SendMessageW
GetMessageW
TranslateMessage
IsWindow
DispatchMessageW
CharUpperW
PostThreadMessageW
CharNextW
SetWindowTextW
LoadIconW
GetClassInfoExW
UnregisterClassW
SetRect
AdjustWindowRect
IsZoomed
LoadCursorW
SetCursor
AppendMenuW
OffsetRect
IntersectRect
SystemParametersInfoA
EnableWindow
ShowWindow
CopyRect
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
CreateWindowExW
LoadAcceleratorsW
RegisterClassExW
DefWindowProcW
SetForegroundWindow
DestroyWindow
IsChild
TranslateAcceleratorW
IsDialogMessageW
DialogBoxParamW
CreateDialogParamW
MessageBoxW
AllowSetForegroundWindow
GetWindowLongW
SetWindowLongW
IsDlgButtonChecked
KillTimer
SetTimer
CheckDlgButton
EndDialog
PostMessageW
SystemParametersInfoW
GetClassInfoW
DefDlgProcW
RegisterClassW
PtInRect
IsRectEmpty
MonitorFromWindow
GetMonitorInfoW
LoadStringW
UnregisterClassA
EqualRect
InsertMenuW
CreateMenu
ModifyMenuW
GetSystemMenu
SetWindowPos
GetClientRect
UpdateWindow
InvalidateRect
IsWindowVisible
SetWindowPlacement
LockWindowUpdate
MoveWindow
AdjustWindowRectEx
EnableMenuItem
PostQuitMessage
CharLowerW
FillRect
CheckRadioButton
GetCursorPos
GetWindowDC
DrawIconEx
GetFocus
MapDialogRect
ScreenToClient
GetWindow
DrawTextW
EnumDisplayMonitors
GetDesktopWindow
CreateDialogIndirectParamW
GetDlgItemTextW
MapWindowPoints
BeginPaint
DrawIcon
EndPaint
SendDlgItemMessageW
GetDC
ReleaseDC
DestroyIcon
GetMenu
LoadImageW
IsWindowEnabled
RedrawWindow
ShowWindowAsync

msvcrt

_errno
_wcslwr
iswdigit
_wtol
wcstok
wcschr
_wcsnicmp
calloc
__getmainargs
_cexit
_exit
wcsrchr
srand
time
iswspace
toupper
_wtoi
wcspbrk
towupper
towlower
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
memcpy
_vsnprintf
wcsncmp
wcsstr
memmove
_wcsicmp
_vsnwprintf
_purecall
_amsg_exit
__setusermatherr
__p__commode
bsearch
ungetc
_fileno
_read
__pioinfo
__p__fmode
wcstombs
iswctype
wctomb
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
isdigit
??2@YAPAXI@Z
memset
??_U@YAPAXI@Z
free
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z
_controlfp
?terminate@@YAXXZ
_CIpow
_onexit
_lock
__dllonexit
_unlock
realloc
__set_app_type
__badioinfo

ole32

CoRevokeClassObject
CLSIDFromString
StringFromGUID2
CoTaskMemFree
CoRegisterClassObject
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

UnRegisterTypeLi
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
VarUI4FromStr
SafeArrayGetVartype
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SysStringByteLen
VariantClear
SysAllocStringLen
SafeArrayCreate
VariantInit
SysAllocStringByteLen
SysStringLen

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ExtractIconW
ShellExecuteExW
SHAddToRecentDocs
SHGetDesktopFolder

comctl32

ImageList_ReplaceIcon
ImageList_LoadImageW
InitCommonControlsEx
ImageList_Create
ImageList_Destroy
ord17

comdlg32

GetFileTitleW
GetSaveFileNameW
GetOpenFileNameW

shlwapi

PathFindExtensionW
PathAppendW
PathFindFileNameW
SHStrDupW
PathStripPathW
PathRemoveFileSpecW

crypt32

CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertFreeCertificateChain
CryptBinaryToStringW
CryptStringToBinaryW
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertGetCertificateContextProperty
CryptMsgClose
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignMessage
CertCloseStore
CryptVerifyDetachedMessageSignature
CryptUnprotectData
CryptProtectData
CryptDecodeObject
CertFindExtension
CertGetEnhancedKeyUsage
CertGetCertificateChain

credui

CredUIParseUserNameW
CredUIPromptForCredentialsW

secur32

LsaConnectUntrusted
GetUserNameExW
FreeContextBuffer
QuerySecurityPackageInfoW
LsaLookupAuthenticationPackage
LsaDeregisterLogonProcess

cryptui

CryptUIDlgViewCertificateW

ntdll

RtlInitString
NtOpenFile
RtlInitUnicodeString
RtlInitializeCriticalSection
RtlUnwind

cfgmgr32

CM_Get_Parent
CM_Get_Child
CM_Get_DevNode_Registry_PropertyW
CM_Get_Sibling

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryOption
WinHttpCloseHandle

winmm

timeKillEvent
timeSetEvent
timeGetTime

netapi32

NetGetJoinInformation
NetApiBufferFree

Sections

.text
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 593KB - Virtual size: 593KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tcaxxre
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7faf18cfe07a252c2dc8cf04b99d54c2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shell32

comctl32

comdlg32

shlwapi

crypt32

credui

secur32

cryptui

ntdll

cfgmgr32

winhttp

winmm

netapi32

Sections

.text Size: 398KB - Virtual size: 397KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 593KB - Virtual size: 593KB

.reloc Size: 55KB - Virtual size: 56KB

tcaxxre Size: - Virtual size: 4KB

.text
Size: 398KB - Virtual size: 397KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 593KB - Virtual size: 593KB

.reloc
Size: 55KB - Virtual size: 56KB

tcaxxre
Size: - Virtual size: 4KB