c332210286b549152d3dd0929033066aa00430e702da569aac9ff4b39f1e8a43

Sharing

Copy URL Twitter E-mail

General

Target

c332210286b549152d3dd0929033066aa00430e702da569aac9ff4b39f1e8a43
Size

5.1MB
MD5

e87d9e3e8c1b4b0697f62d9324b54673
SHA1

cfebedd72c439edbbf312d927620016d66184033
SHA256

c332210286b549152d3dd0929033066aa00430e702da569aac9ff4b39f1e8a43
SHA512

7725c5d21f9e08247fac0a8ac03995d40d85733e791c34d90f5e12a35d4f645fc30f0b9c8b0c54057c71d8428fb10b862b03bb7ab22ae90ae97d3284304d5a25
SSDEEP

98304:g1mXFaYklJQFCfqgOxSx3TABz7A+s35JXTNoD:L1a7lJQFCfyxSx34zqJj+D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c332210286b549152d3dd0929033066aa00430e702da569aac9ff4b39f1e8a43

Files

c332210286b549152d3dd0929033066aa00430e702da569aac9ff4b39f1e8a43
.exe windows:6 windows x86 arch:x86

98efaaf97339506903dc91d98c45b886

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\GitLab-Runner\builds\iVTFS-Df\0\Integration\wiservice\deploy\oi_release\WildixOutlookSync32.pdb

Imports

crypt32

CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreA
CertOpenStore

ws2_32

recvfrom
gethostname
getpeername
htons
inet_ntop
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
socket
send
recv
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
WSASend
select
shutdown
listen
WSASetLastError
WSASocketW
getaddrinfo
getsockname
ntohs
connect
WSARecv
getsockopt
htonl
freeaddrinfo
ioctlsocket
setsockopt
WSAGetLastError
WSACleanup
WSAStartup
inet_pton
sendto

wldap32

ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord217
ord143
ord200
ord301

kernel32

CreateWaitableTimerA
HeapFree
HeapAlloc
GetProcessHeap
WaitForMultipleObjectsEx
OpenEventA
InitializeSListHead
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDBCSLeadByteEx
GetCurrencyFormatW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
CompareStringW
LCMapStringW
FoldStringW
EnumSystemLocalesA
IsValidCodePage
GetLocaleInfoA
CreateEventA
OutputDebugStringW
AreFileApisANSI
MoveFileExW
CreateDirectoryExW
DeviceIoControl
SetFilePointerEx
SetEndOfFile
GetFullPathNameW
SetWaitableTimer
TlsSetValue
GetConsoleScreenBufferInfo
SetLastError
SetConsoleTextAttribute
EnterCriticalSection
GetStdHandle
CreateWaitableTimerW
WriteConsoleA
WriteFile
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
GetDynamicTimeZoneInformation
LeaveCriticalSection
GetQueuedCompletionStatus
InitializeCriticalSectionEx
WaitForSingleObject
GetCurrentThreadId
PostQueuedCompletionStatus
CreateEventW
GetConsoleMode
FormatMessageW
GetLastError
SetEvent
TerminateThread
TlsAlloc
CloseHandle
QueueUserAPC
DecodePointer
LocalFree
DeleteCriticalSection
GetCurrentProcessId
WideCharToMultiByte
SleepEx
TlsGetValue
TlsFree
FormatMessageA
CreateIoCompletionPort
OutputDebugStringA
GetFileAttributesW
Sleep
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
CancelIoEx
GetSystemTimeAsFileTime
CreateMutexW
GetProcAddress
ExpandEnvironmentStringsW
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleW
FreeLibrary
GetVersionExW
GetModuleHandleA
OpenProcess
GetProcessTimes
GetModuleFileNameW
ProcessIdToSessionId
GetCurrentProcess
GetSystemInfo
IsWow64Process
QueryPerformanceFrequency
QueryPerformanceCounter
WriteConsoleW
GetModuleHandleExW
GetEnvironmentVariableW
GetFileType
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
RtlCaptureContext
CreateFileW
SetUnhandledExceptionFilter
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
CreateThread
GetProcessId
VirtualQueryEx
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
ResetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
GetSystemDirectoryA
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetEnvironmentVariableA
ReadFile
PeekNamedPipe
VerSetConditionMask
VerifyVersionInfoW
GetFileTime
GetFileInformationByHandle
GetFileAttributesExW
FlushFileBuffers
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
GetCPInfo
CompareStringEx
GetStringTypeW
LCMapStringEx
GetLocaleInfoEx
EncodePointer
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
SetStdHandle
ExitProcess
SetConsoleCtrlHandler
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetConsoleOutputCP
HeapReAlloc
HeapSize
GetFileSizeEx
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FindFirstFileExW
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RtlUnwind
IsDebuggerPresent
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
RaiseException
InitializeSRWLock
TryAcquireSRWLockExclusive
GetExitCodeThread

user32

TranslateMessage
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetMessageW
DispatchMessageW

advapi32

CryptReleaseContext
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegSetValueExW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
RegQueryValueExW
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegCreateKeyExW
RegDeleteTreeW

shell32

SHGetSpecialFolderPathW

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 895KB - Virtual size: 895KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 211KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98efaaf97339506903dc91d98c45b886

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

ws2_32

wldap32

kernel32

user32

advapi32

shell32

bcrypt

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 895KB - Virtual size: 895KB

.data Size: 211KB - Virtual size: 245KB

.rsrc Size: 99KB - Virtual size: 99KB

.reloc Size: 168KB - Virtual size: 167KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 895KB - Virtual size: 895KB

.data
Size: 211KB - Virtual size: 245KB

.rsrc
Size: 99KB - Virtual size: 99KB

.reloc
Size: 168KB - Virtual size: 167KB