223a3aa520689c0021d8ce51024d5bb0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

223a3aa520689c0021d8ce51024d5bb0N.exe
Size

3.7MB
MD5

223a3aa520689c0021d8ce51024d5bb0
SHA1

1fbcb94006ea1b3dd1796cebe0e78fb0b9b6a874
SHA256

66ffa9d4e27a9f787eaa47364d57b95feae92af35ab154299c5134eacc9f4c42
SHA512

b329830a0b22310e4262bd071edfaf38afa199bb428dc1f99b31c83df0f699eb842e6a466d803670d5066780217e7eb966e505262c3620eeb922629ee6883fe3
SSDEEP

98304:ziXAEqfpQA7KhbchheGvUapVXNe1gNuqh+CaO:eQxRQA7K9QPfZNe1rqh+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
223a3aa520689c0021d8ce51024d5bb0N.exe

Files

223a3aa520689c0021d8ce51024d5bb0N.exe
.dll windows:5 windows x86 arch:x86

0566bf4ce656c9433015abeb3ee79fc7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

VssProvider.pdb

Imports

advapi32

RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExW
RegSetValueExW
GetUserNameA
CryptDestroyHash
CryptGetHashParam
CryptHashData
RegQueryValueExA
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
CryptCreateHash
OpenThreadToken
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegSetValueExA
RegEnumKeyExA
RegCreateKeyExA
RegDeleteValueA
RegEnumValueA

kernel32

MultiByteToWideChar
lstrlenA
lstrlenW
WideCharToMultiByte
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
GetProcessHeap
LocalAlloc
ReadFile
LeaveCriticalSection
GetLastError
CreateFileW
GetFileType
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
RaiseException
SizeofResource
LockResource
LoadResource
WaitForSingleObject
SetEvent
ResetEvent
WaitForMultipleObjects
SetThreadPriority
InterlockedCompareExchange
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetACP
GetLocaleInfoA
LoadLibraryW
FreeLibrary
FindAtomW
CompareFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentThread
WriteFile
GetFileInformationByHandle
OpenEventA
GetVersionExA
GetProfileIntA
GlobalFree
CreateEventA
GetUserDefaultLCID
IsDBCSLeadByte
lstrcmpiA
LoadLibraryExA
GetUserDefaultUILanguage
FindClose
SetFileTime
GetCurrentProcessId
LocalFree
HeapSize
HeapReAlloc
HeapDestroy
CreateDirectoryW
DeleteFileW
FindFirstFileW
ResumeThread
FindNextFileW
FindResourceW
FormatMessageW
GetDateFormatW
GetFileAttributesW
GetFullPathNameW
GetModuleFileNameW
GetVersionExW
GetSystemDirectoryW
GetTempPathW
GetTimeFormatW
HeapFree
GlobalAddAtomW
LoadLibraryExW
MoveFileW
MoveFileExW
OutputDebugStringW
SetFileAttributesW
FindResourceExA
GlobalDeleteAtom
GetSystemDefaultLCID
GetSystemTimeAsFileTime
GetThreadLocale
SetThreadLocale
GetEnvironmentVariableW
TryEnterCriticalSection
GetTickCount
GetModuleHandleA
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
InterlockedExchange
FindResourceA
lstrcmpA
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameA
SetLastError
Sleep
InitializeCriticalSection
DuplicateHandle

gdi32

SetROP2
SetBrushOrgEx
UnrealizeObject
CreateBitmap
CreatePatternBrush
GetNearestColor
GetClipBox
IntersectClipRect
GetBkColor
ExcludeClipRect
SetTextAlign
Polygon
CreateFontIndirectW
GetTextExtentPoint32W
GetTextExtentExPointW
SetPixel
GetPixel
CreateRectRgnIndirect
SelectClipRgn
SetBkMode
SetTextColor
SetBkColor
PatBlt
SelectObject
GetTextMetricsA
DeleteObject
ExtCreatePen
MoveToEx
LineTo
GetStockObject
CreatePen
Rectangle
GetDeviceCaps
GetObjectA
DeleteDC
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
CreateErrorInfo
SafeArrayCopy
VariantClear
VariantInit
SetErrorInfo
GetErrorInfo
VariantChangeType
VarUI4FromStr
UnRegisterTypeLi
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayUnlock
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayDestroy
VariantCopy

ole32

CLSIDFromProgID
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
OleUninitialize
OleInitialize
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
OleRun
CoCreateGuid
CoDisconnectObject
RegisterDragDrop
StringFromGUID2
OleFlushClipboard
RevokeDragDrop
OleSetClipboard
DoDragDrop
ReleaseStgMedium
OleDuplicateData
IIDFromString
StringFromCLSID
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
OleIsCurrentClipboard
OleLockRunning

user32

GetWindowTextW
GetWindowTextLengthW
GetClassNameW
DrawTextExW
DialogBoxIndirectParamW
DefWindowProcW
CreateDialogIndirectParamW
CallWindowProcW
IsDialogMessageA
IsDialogMessageW
IsWindowUnicode
CreateWindowExW
SendMessageW
CreateCaret
ShowCaret
EnumChildWindows
RegisterClipboardFormatA
ScrollWindow
SetScrollInfo
KillTimer
FrameRect
DrawFrameControl
InvertRect
GetQueueStatus
GetDlgCtrlID
GetKeyState
GetIconInfo
GetCursorPos
IntersectRect
PtInRect
MonitorFromPoint
MonitorFromRect
SystemParametersInfoA
CallNextHookEx
GetForegroundWindow
UnhookWindowsHookEx
PostThreadMessageA
GetTopWindow
UnregisterClassA
CopyRect
SetRect
SendDlgItemMessageA
GetScrollPos
GetActiveWindow
GetAncestor
CharNextW
MapDialogRect
SetWindowContextHelpId
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
BeginPaint
EndPaint
IsChild
GetFocus
GetClassNameA
CharNextA
SetWindowLongA
RedrawWindow
GetClassInfoExA
RegisterClassExA
CreateWindowExA
CreateAcceleratorTableA
ClientToScreen
SetCapture
FillRect
InvalidateRgn
GetDC
GetDesktopWindow
DestroyAcceleratorTable
DestroyWindow
CallWindowProcA
EndDialog
GetNextDlgTabItem
WindowFromPoint
ReleaseDC
GetDCEx
MessageBeep
GetWindow
GetWindowLongA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
SetTimer
UpdateWindow
EnableWindow
InvalidateRect
IsWindowVisible
EnableMenuItem
GetSystemMenu
MoveWindow
ReleaseCapture
GetCapture
DestroyIcon
LoadImageA
GetSysColor
ShowScrollBar
SetWindowPos
ShowWindow
ScreenToClient
GetWindowRect
GetParent
PostMessageA
GetClientRect
IsWindow
GetSystemMetrics
SetFocus
SendMessageA
GetDlgItem
GetCursor
SetCursor
LoadCursorA
LoadIconA
IsIconic
DefWindowProcA
MessageBoxW
RegisterWindowMessageW
SetWindowTextW
SetWindowsHookExW
GetPropW
SetPropW
RemovePropW
RegisterClassExW
SetWindowLongW
GetWindowLongW
DeleteMenu
UnionRect
BeginDeferWindowPos
EqualRect
DeferWindowPos
EndDeferWindowPos
ChildWindowFromPoint
IsWindowEnabled
DrawFocusRect
LoadBitmapA
InflateRect
GetScrollInfo

shell32

SHGetFileInfoW

comctl32

InitCommonControlsEx
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Create
ImageList_GetIcon
ImageList_Destroy
ImageList_LoadImageA
ImageList_SetBkColor
ImageList_ReplaceIcon

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

RollbackTransac
RollbackTransacti
CommitTransaction
CreateTransaction
RollbackTransaction
CreateTransaction

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0566bf4ce656c9433015abeb3ee79fc7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

oleaut32

ole32

user32

shell32

comctl32

version

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.data Size: 9KB - Virtual size: 32KB

.shared Size: 512B - Virtual size: 4KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 9KB - Virtual size: 32KB

.shared
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB