115eeef204a04bad7413ec8524e68722b043cfbe11f518716e5c5494edc751e9

Sharing

Copy URL

Twitter E-mail

General

Target

115eeef204a04bad7413ec8524e68722b043cfbe11f518716e5c5494edc751e9
Size

961KB
MD5

b40d1b75edecf9188236c57532f4063c
SHA1

20912dd941312abc8c793a52f18d6998b16c1bfb
SHA256

115eeef204a04bad7413ec8524e68722b043cfbe11f518716e5c5494edc751e9
SHA512

be3b6ae6f5846d3707d9d827c2f399d352acd92ae2dfea7c3feb6200ece146c4a271ff97663f476a2ce519b3d3956422368450fc3e9455c9bc884158e5412030
SSDEEP

24576:65GrfSvcRWantrn9br0+QT2MZwg5KzwQM:657Yt5beTjZwgcBM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
115eeef204a04bad7413ec8524e68722b043cfbe11f518716e5c5494edc751e9

Files

115eeef204a04bad7413ec8524e68722b043cfbe11f518716e5c5494edc751e9
.exe windows:5 windows x86 arch:x86

de0f16190cf9bb93738bb1b53b645ac9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\code_version\code_3.2.5.1\rel\PDFRunningHelper.pdb

Imports

kernel32

GetThreadLocale
SetThreadLocale
GetWindowsDirectoryW
SetUnhandledExceptionFilter
GetLocalTime
IsBadReadPtr
VirtualProtect
ExitProcess
InitializeCriticalSection
MapViewOfFile
UnmapViewOfFile
OpenEventW
OpenFileMappingW
SetEndOfFile
RemoveDirectoryW
GetLongPathNameW
DeviceIoControl
lstrcmpA
GetFileTime
GetFileSize
DeleteFileW
Sleep
TerminateProcess
DecodePointer
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
FreeLibrary
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetCurrentProcess
SetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
ExitThread
FindFirstFileExW
RtlUnwind
FreeLibraryAndExitThread
GetThreadTimes
Process32NextW
UnhandledExceptionFilter
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
Process32FirstW
CreateToolhelp32Snapshot
SystemTimeToFileTime
GetSystemTime
GetComputerNameW
LocalFree
GetQueuedCompletionStatus
InterlockedExchange
CreateIoCompletionPort
CreateEventW
TerminateThread
GetExitCodeThread
GetSystemInfo
PostQueuedCompletionStatus
SetEvent
ResetEvent
GetNativeSystemInfo
MoveFileExW
SetFileAttributesW
lstrlenA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
FindNextFileW
FindFirstFileW
lstrlenW
GetFileAttributesExW
GetVersionExW
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
ReadFile
CreateProcessW
GetStartupInfoW
CreatePipe
SetProcessShutdownParameters
WriteFile
OutputDebugStringW
CloseHandle
SetFilePointer
CreateFileW
SetLastError
RaiseException
GetCurrentThreadId
GetPrivateProfileStringW
GetTickCount
WritePrivateProfileStringW
GetPrivateProfileIntW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetLastError
HeapDestroy
TlsAlloc
QueryPerformanceCounter
GetCPInfo
WaitForSingleObjectEx
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
FlushFileBuffers
GetCurrentThread
CreateThread
FormatMessageW
LoadLibraryW
WaitForSingleObject
GetVersion
GetCurrentProcessId
OpenProcess
GetModuleFileNameW
GetConsoleCP

user32

DestroyWindow
SendMessageW
wsprintfW
UnregisterClassW
RegisterClassExW
IsWindow
LoadCursorW
CreateWindowExW
SetWindowLongW
GetWindowLongW
CallWindowProcW
ShowWindow
GetClassInfoExW
CharNextW
FindWindowW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
PostQuitMessage
CharLowerBuffW
MessageBoxW
KillTimer
SetTimer
DefWindowProcW

advapi32

ConvertSidToStringSidW
LookupAccountNameW
GetUserNameW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
RegEnumKeyW
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityInfo
DeleteAce
EqualSid
GetAce
GetSecurityInfo
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
CloseServiceHandle
CreateServiceW
OpenSCManagerW

shell32

SHGetSpecialFolderPathW
SHChangeNotify
SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetFolderPathW
ord165
ShellExecuteW
ShellExecuteExW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CLSIDFromProgID
OleRun
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree

oleaut32

VariantCopy
SysStringLen
SysFreeString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocString
GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantInit
SysAllocStringLen
VariantClear
VarBstrCmp

shlwapi

PathSearchAndQualifyW
StrStrIW
PathIsDirectoryW
AssocQueryStringW
SHDeleteValueW
SHSetValueW
SHDeleteKeyW
SHGetValueW
PathCanonicalizeW
PathRemoveBackslashW
PathIsPrefixW
PathCombineW
PathRemoveExtensionW
PathFindExtensionW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW

wininet

InternetCloseHandle
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetSetOptionW
InternetOpenW
InternetCrackUrlW
HttpQueryInfoW
InternetReadFile

gdiplus

GdiplusStartup

crypt32

CryptBinaryToStringW
CryptStringToBinaryW

netapi32

Netbios

secur32

GetUserNameExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

EnumProcessModules

iphlpapi

GetAdaptersInfo
GetIpAddrTable

Sections

.text
Size: 588KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de0f16190cf9bb93738bb1b53b645ac9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

gdiplus

crypt32

netapi32

secur32

version

psapi

iphlpapi

Sections

.text Size: 588KB - Virtual size: 588KB

.rdata Size: 175KB - Virtual size: 175KB

.data Size: 12KB - Virtual size: 29KB

.gfids Size: 1024B - Virtual size: 1000B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 151KB - Virtual size: 150KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 588KB - Virtual size: 588KB

.rdata
Size: 175KB - Virtual size: 175KB

.data
Size: 12KB - Virtual size: 29KB

.gfids
Size: 1024B - Virtual size: 1000B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 151KB - Virtual size: 150KB

.reloc
Size: 32KB - Virtual size: 31KB