14c51b2aeb14d5ac7457e892a97e330a916ff9056a72ecdc4b8c13a3d47052c7

Sharing

Copy URL Twitter E-mail

General

Target

14c51b2aeb14d5ac7457e892a97e330a916ff9056a72ecdc4b8c13a3d47052c7
Size

1.5MB
MD5

f804136151f1909ff8b88581a5b411f7
SHA1

d37a72fb8ec7fe1ca79c54c4bfee16dae2fcae69
SHA256

14c51b2aeb14d5ac7457e892a97e330a916ff9056a72ecdc4b8c13a3d47052c7
SHA512

a69061a7de90eed946e064a99ba09338746f64978cedf44289113fc45c51b07ba138d288aa53420c4d764c3d749ab8e268ea80aa7edfc3fbee5260953d5b60b0
SSDEEP

49152:mIlbhq5Vwc/E/4rt4XuV8cls5sfFI6sa8zxR4ChooNZrjWqYHf6qY8FVc4Jk2LUq:jBhq5Vwc/E/4rt4E8ss5sfFI6sa8zxRg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14c51b2aeb14d5ac7457e892a97e330a916ff9056a72ecdc4b8c13a3d47052c7

Files

14c51b2aeb14d5ac7457e892a97e330a916ff9056a72ecdc4b8c13a3d47052c7
.exe windows:5 windows x86 arch:x86

87f6d0e056c7da19e182fbf725abf4cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileSectionA
QueryPerformanceFrequency
DeleteFileA
GlobalAlloc
OutputDebugStringA
GetComputerNameA
HeapAlloc
HeapFree
GetProcessHeap
DosDateTimeToFileTime
lstrlenA
SetFileTime
WriteFile
GetFileAttributesA
lstrcatA
GetFileTime
lstrcpyA
LocalFileTimeToFileTime
MultiByteToWideChar
LocalFree
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
GetPrivateProfileStringA
FileTimeToLocalFileTime
ResetEvent
GetVersionExA
QueryDosDeviceA
GetDriveTypeA
GetVolumeInformationA
GetLogicalDriveStringsA
LocalAlloc
DeviceIoControl
FindFirstVolumeA
FindNextVolumeA
CreateFileW
MoveFileExA
FormatMessageA
GetSystemWindowsDirectoryA
GetModuleFileNameA
RemoveDirectoryA
SetFileAttributesA
SetUnhandledExceptionFilter
GetModuleHandleW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FindFirstFileW
FindNextFileW
SystemTimeToTzSpecificLocalTime
GetDiskFreeSpaceExA
GetCurrentProcessId
SystemTimeToFileTime
GetSystemTime
FindNextFileA
UnmapViewOfFile
GetLocalTime
GetFileInformationByHandle
InterlockedIncrement
GlobalFree
ResumeThread
UnhandledExceptionFilter
IsDebuggerPresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
SetStdHandle
GetLocaleInfoW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
RtlUnwind
FlushFileBuffers
GetPrivateProfileSectionNamesA
LockResource
MoveFileA
FindClose
CopyFileA
FindFirstFileA
CreateDirectoryA
GetSystemDirectoryA
ReadFile
CreateProcessA
GetExitCodeProcess
SizeofResource
FindResourceExA
GetWindowsDirectoryA
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
LoadResource
lstrcmpA
FindResourceA
GetFileSize
CreateFileA
ProcessIdToSessionId
LoadLibraryA
GetProcAddress
lstrlenW
WideCharToMultiByte
FreeLibrary
CreateEventA
GetComputerNameW
CreateThread
CloseHandle
CreateToolhelp32Snapshot
GetModuleHandleA
WaitForMultipleObjects
SetConsoleCtrlHandler
GetConsoleMode
ExitProcess
GetConsoleCP
GetTimeZoneInformation
GetStartupInfoA
SetHandleCount
GetCurrentDirectoryA
GetFileType
PeekNamedPipe
GetFullPathNameA
VirtualAlloc
VirtualFree
HeapDestroy
GetCurrentThreadId
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
Process32Next
GetLastError
TerminateProcess
Sleep
OpenProcess
SetEvent
WaitForSingleObject
Process32First
SetFilePointer
GetCurrentProcess
LCMapStringW
HeapSize
RaiseException
GetStdHandle
InterlockedExchange
HeapCreate
InitializeCriticalSectionAndSpinCount
ExitThread

user32

RegisterDeviceNotificationA
SetCursor
GetDesktopWindow
WaitForInputIdle
GetGUIThreadInfo
LoadCursorA
UpdateWindow
DispatchMessageA
ShowWindow
GetSystemMetrics
CreateWindowExA
TranslateMessage
SendMessageA
LoadIconA
PostQuitMessage
RegisterClassExA
GetMessageA
DefWindowProcA

advapi32

GetTokenInformation
OpenProcessToken
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
RegQueryValueExA
RegOpenKeyExA
SetServiceStatus
ConvertSidToStringSidW
LookupAccountNameW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
IsValidSid
ConvertSidToStringSidA
RegOpenKeyExW
LookupAccountSidA
CreateProcessAsUserA
ControlService
RegEnumValueA
OpenSCManagerA
QueryServiceStatusEx
RegDeleteValueA
RegQueryInfoKeyA
ChangeServiceConfigA
StartServiceA
RegEnumKeyExA
RegQueryValueExW
CloseServiceHandle
OpenServiceA
DuplicateTokenEx
RegSetValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExA
SHGetFolderPathA
SHFileOperationA

ole32

CoInitializeEx
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoUninitialize

oleaut32

VariantInit
SysAllocStringByteLen
SafeArrayCreateVector
SysStringLen
SafeArrayUnaccessData
SafeArrayGetUBound
SysFreeString
SafeArrayGetElement
SafeArrayDestroy
VariantClear
SafeArrayGetLBound
SysAllocString
SafeArrayAccessData

iphlpapi

GetAdaptersInfo
SendARP
GetTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetIpNetTable

netapi32

DsRoleGetPrimaryDomainInformation
NetUserEnum
NetUserGetInfo
NetWkstaGetInfo
NetApiBufferFree

shlwapi

PathCombineA
SHDeleteKeyA

ws2_32

inet_addr
select
WSAGetLastError
htons
ntohs
__WSAFDIsSet
WSAStartup
accept
WSAWaitForMultipleEvents
WSAResetEvent
htonl
listen
send
connect
ioctlsocket
WSACleanup
inet_ntoa
closesocket
WSACreateEvent
bind
recv
socket
setsockopt
WSASetEvent
WSAEventSelect
WSAEnumNetworkEvents

psapi

GetProcessMemoryInfo
GetProcessImageFileNameA
EnumProcesses

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wininet

InternetCanonicalizeUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlA

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupDiGetClassDevsA
CM_Get_DevNode_Status
CM_Get_Device_IDA
CM_Get_Parent
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW

wtsapi32

WTSQueryUserToken
WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSCloseServer
WTSWaitSystemEvent
WTSOpenServerA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

urlmon

URLDownloadToFileA

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87f6d0e056c7da19e182fbf725abf4cb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

netapi32

shlwapi

ws2_32

psapi

version

wininet

setupapi

wtsapi32

userenv

urlmon

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 248KB - Virtual size: 248KB

.data Size: 15KB - Virtual size: 79KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 92KB - Virtual size: 92KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 248KB - Virtual size: 248KB

.data
Size: 15KB - Virtual size: 79KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 92KB - Virtual size: 92KB