f79d7b0243e37e86a837bef8a81909a0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f79d7b0243e37e86a837bef8a81909a0N.exe
Size

609KB
MD5

f79d7b0243e37e86a837bef8a81909a0
SHA1

9efa83c7227321d65676c6b08ac49095a6e75867
SHA256

814291c0de19196947a0521e88bf07484eeca38d7146c65bfbc4ad0202274d65
SHA512

96efa0946bc0c99a1af494147ac7b45319a77e20c75bf2e61308c561d8c43a9705fa8a53997bb9796d4aa30e8bf7188a209a21903ef39bbf993dbf846c809408
SSDEEP

12288:0zfq7czYKqFaFGe42d9ERx9veGl/F4Dimyoho1PTfQ3GwlBq:0zy41qYIOEF2c/FG8M3G+q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f79d7b0243e37e86a837bef8a81909a0N.exe

Files

f79d7b0243e37e86a837bef8a81909a0N.exe
.exe windows:5 windows x86 arch:x86

a6cb4e353a1853a2145c16f94051eca0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\utdated\portal\MaxPendingSessio.pdb

Imports

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
VirtualAlloc
HeapReAlloc
HeapSize
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
CloseHandle
SetFilePointer
LoadLibraryW
ExitProcess
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
ReadFile
GetFileType
SetHandleCount
SetLastError
TlsFree
HeapAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
CreateFileA
FreeLibrary
VirtualQuery
SetEndOfFile
EnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
InitializeCriticalSection
DebugBreak
DeleteFileW
GetModuleHandleA
GetModuleFileNameA
TlsAlloc
GetModuleHandleW
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
LeaveCriticalSection
HeapFree
GetProcessHeap
GetProcAddress
GetLastError
RaiseException
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetCommandLineA
TerminateProcess
GetModuleFileNameW
GetConsoleOutputCP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
Sleep
QueryDosDeviceA
InterlockedDecrement
GetStdHandle
InterlockedIncrement
CreateNamedPipeA

user32

DestroyIcon
CheckMenuItem
LoadCursorA
UpdateWindow
DispatchMessageA
IsWindow
IsDlgButtonChecked
CreatePopupMenu
SetMenu
ShowWindow
EnumWindowStationsW
LoadAcceleratorsA
GetCursorPos
GetDesktopWindow
DefWindowProcA
RegisterClassA
GetDlgItemTextA
GetDlgItem
TranslateAcceleratorA
EndPaint
SetCursor
GetMessageA
GetWindowRect
InsertMenuItemA
GetWindowDC
FillRect
GetFocus
LoadIconA
GetClientRect
CreateMenu
GetWindowTextLengthA
SendMessageA
BeginPaint
GetScrollRange
GetDC
DrawFocusRect
TranslateMessage
GetForegroundWindow
GetMenu
TrackPopupMenuEx
GetAsyncKeyState
SetRect
AppendMenuW
CreateWindowExA
ReleaseDC

gdi32

BitBlt
PatBlt
DeleteDC
CreateDIBSection
CreateDCA
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
StartDocA
FillRgn
RectVisible
GetStockObject
CreateSolidBrush

winspool.drv

ord201

comdlg32

ChooseColorA

advapi32

GetTokenInformation

shell32

SHGetFolderPathA

ole32

CoUninitialize
CoInitializeSecurity
CoCreateInstance
GetRunningObjectTable
CoInitialize
CoInitializeEx
CoSetProxyBlanket
StringFromCLSID
CoCreateGuid

oleaut32

SysFreeString
SysAllocString

avifil32

AVIStreamWrite

winscard

SCardDisconnect
SCardTransmit
SCardEstablishContext
SCardConnectA
SCardReleaseContext

iphlpapi

GetTcpTable

shlwapi

PathRemoveFileSpecA
PathAppendA
PathFileExistsA

comctl32

ImageList_Create
ImageList_ReplaceIcon
ord17

opengl32

glLoadIdentity
glClearColor
glShadeModel
glClearDepth
glMaterialfv
glEnable
glLightfv
glViewport
glMatrixMode
glCullFace
glDepthFunc

dbghelp

SymGetLineFromAddr
SymGetFileLineOffsets64
SymGetLineFromName

Sections

.extjmp
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text-c
Size: 335KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a6cb4e353a1853a2145c16f94051eca0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

avifil32

winscard

iphlpapi

shlwapi

comctl32

opengl32

dbghelp

Sections

.extjmp Size: 199KB - Virtual size: 199KB

.rdata Size: 49KB - Virtual size: 48KB

.data Size: 8KB - Virtual size: 15KB

.text-c Size: 335KB - Virtual size: 335KB

.l1 Size: 8KB - Virtual size: 8KB

.l1 Size: 8KB - Virtual size: 8KB

.extjmp
Size: 199KB - Virtual size: 199KB

.rdata
Size: 49KB - Virtual size: 48KB

.data
Size: 8KB - Virtual size: 15KB

.text-c
Size: 335KB - Virtual size: 335KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB