c18db34a8ab42c043e2a4d1d82a0fc3a30cdc41d74fd8ff49b8dcd3c54e10cf6

Sharing

Copy URL

Twitter E-mail

General

Target

c18db34a8ab42c043e2a4d1d82a0fc3a30cdc41d74fd8ff49b8dcd3c54e10cf6
Size

1.4MB
MD5

53e66348f578d46ad0b2e6bbf0d416ec
SHA1

28fee1e7cf002c8096c1d7fe9dc1dd9d2d83887f
SHA256

c18db34a8ab42c043e2a4d1d82a0fc3a30cdc41d74fd8ff49b8dcd3c54e10cf6
SHA512

fa99eaa4613c786130246dc2ed2d31c34ad0cf10cc9243affaaf99dbbaafbe8ebc24ef5c04880ffae7b43110a9ee393f51754d44f4a97c815afe8dc306f5f957
SSDEEP

24576:5ecSNjIohfwK58W0c3k9A99JFWt8HhGokqxTiAQn9VOorEH7+:5pCp58W0c3kejJcORpiAMnH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c18db34a8ab42c043e2a4d1d82a0fc3a30cdc41d74fd8ff49b8dcd3c54e10cf6

Files

c18db34a8ab42c043e2a4d1d82a0fc3a30cdc41d74fd8ff49b8dcd3c54e10cf6
.exe windows:4 windows x86 arch:x86

e9b39c8092deb6c54b4f786339533f0f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\temp\ICCS_Temp\Installer\ICCS\release\setup.pdb

Imports

kernel32

GetFileSize
ReadFile
MultiByteToWideChar
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LoadLibraryW
GetModuleFileNameA
CreateMutexW
WriteFile
CreateThread
WaitForSingleObject
GetLocalTime
GetCommandLineW
GetTickCount
SetFilePointer
EnumResourceLanguagesW
GetUserDefaultLangID
GetUserDefaultUILanguage
GetVersion
ConvertDefaultLocale
GetLocaleInfoW
GetVersionExW
GetCurrentProcess
GetSystemInfo
GetSystemWow64DirectoryW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
CreateProcessW
GetExitCodeProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
ExitProcess
CreateFileW
SetEvent
GetEnvironmentVariableW
SetEndOfFile
LoadLibraryA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetOEMCP
GetACP
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStartupInfoA
SetHandleCount
GetCurrentThreadId
SetLastError
GetFileType
GetStdHandle
HeapCreate
HeapDestroy
CopyFileW
GetTempFileNameW
GetTempPathW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
MoveFileExW
CreateEventW
DeleteFileW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
TlsGetValue
FreeLibrary
RemoveDirectoryW
GetProcAddress
MoveFileW
LoadLibraryExW
SetErrorMode
Sleep
GetFileAttributesW
CompareFileTime
LocalFree
GetModuleFileNameW
WideCharToMultiByte
CloseHandle
GetLastError
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceW
HeapReAlloc
VirtualAlloc
VirtualFree
GetModuleHandleA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetModuleHandleW
TlsFree
TlsSetValue
TlsAlloc
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
RaiseException
GetCPInfo
GetStartupInfoW
GetProcessHeap
GetVersionExA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleMode
GetConsoleCP
HeapFree
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange

user32

EndDialog
SetTimer
SetDlgItemTextW
MessageBoxW
wsprintfW
KillTimer
SendDlgItemMessageW
MonitorFromWindow
GetMonitorInfoW
OffsetRect
GetWindowLongW
AdjustWindowRect
GetWindowRect
GetDlgItem
DrawTextW
SetWindowTextW
LoadIconW
MessageBoxIndirectW
SetRectEmpty
PostMessageW
EnableWindow
ReleaseDC
GetDC
SetFocus
ShowWindow
DialogBoxIndirectParamW
SetWindowPos
GetClientRect
ExitWindowsEx
EnumWindows
SendMessageW
GetWindowThreadProcessId
GetWindowModuleFileNameW
SendMessageTimeoutW
LoadStringW
DialogBoxParamW

gdi32

GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
DeleteObject
CreateFontW
GetStockObject
SetBkMode
SetTextColor
DeleteDC

advapi32

RegQueryValueExW
SetNamedSecurityInfoW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
IsTextUnicode
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
DeleteService
ControlService
StartServiceW
CloseServiceHandle
ChangeServiceConfigW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
OpenSCManagerW
QueryServiceStatus
RegEnumKeyExW
RegDeleteValueW
RegQueryInfoKeyW
GetNamedSecurityInfoW

shell32

SHCreateDirectoryExW
SHGetFolderPathW
CommandLineToArgvW
SHCreateDirectoryExA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

cabinet

ord22
ord23
ord20
ord21

shlwapi

PathRemoveBackslashW
PathIsRootW
PathIsSystemFolderW
PathMatchSpecA
PathIsDirectoryW
PathAddBackslashW
PathFindExtensionW
PathCombineW
PathStripToRootW
SHDeleteKeyW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathFindFileNameA
PathAddBackslashA
PathRemoveFileSpecA
PathAppendA
PathFindFileNameW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW
EnumProcessModules

Sections

.text
Size: 260KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1016KB - Virtual size: 1013KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e9b39c8092deb6c54b4f786339533f0f

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

cabinet

shlwapi

version

psapi

Sections

.text Size: 260KB - Virtual size: 257KB

.rdata Size: 52KB - Virtual size: 49KB

.data Size: 8KB - Virtual size: 17KB

.rsrc Size: 1016KB - Virtual size: 1013KB

.text
Size: 260KB - Virtual size: 257KB

.rdata
Size: 52KB - Virtual size: 49KB

.data
Size: 8KB - Virtual size: 17KB

.rsrc
Size: 1016KB - Virtual size: 1013KB