af85f214ec08536d519e29f72b8419c95726c03f729c7c121204a965ac5912fa

Sharing

Copy URL Twitter E-mail

General

Target

af85f214ec08536d519e29f72b8419c95726c03f729c7c121204a965ac5912fa
Size

181KB
MD5

08a38cebcce3134ffa88d75ef645925d
SHA1

ebba15265f7fb0df39fab01a29ec6982106e77a2
SHA256

af85f214ec08536d519e29f72b8419c95726c03f729c7c121204a965ac5912fa
SHA512

5665888f359d16668c85751a268b5d9f733fea228b7a6ffed086ca443d1421778d7f6b83063af16b0052c6255dcd6a10979a4f32f682baa34215c31a0bec98fa
SSDEEP

3072:ae7DJ0lHzhQpaCghgPsHloJWxyKUf/jb0Ne3gjq2lQBV+UdE+rECWp7hKmfW/:hJ0lHzC/gNxiXLBV+UdvrEFp7hKmfW/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af85f214ec08536d519e29f72b8419c95726c03f729c7c121204a965ac5912fa

Files

af85f214ec08536d519e29f72b8419c95726c03f729c7c121204a965ac5912fa
.exe windows:5 windows x86 arch:x86

eea9698e432263efe771437768a3ce5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

comctl32

PropertySheetA

setupapi

SetupInstallFilesFromInfSectionA
SetupScanFileQueueA
SetupOpenFileQueue
SetupInitDefaultQueueCallback
SetupSetDirectoryIdA
SetupTerminateFileLog
SetupQueryFileLogA
SetupInitializeFileLogA
SetupGetSourceInfoA
SetupGetLineTextA
SetupDefaultQueueCallbackA
SetupInstallFromInfSectionA
SetupCommitFileQueueA
SetupGetBinaryField
SetupCloseInfFile
SetupGetIntField
SetupGetStringFieldA
SetupFindFirstLineA
SetupGetSourceFileLocationA
SetupDecompressOrCopyFileA
SetupPromptForDiskA
UnicodeToMultiByte
InstallCatalog
VerifyCatalogFile
SetupTermDefaultQueueCallback
SetupDefaultQueueCallbackW
SetupFindNextLine
SetupQueueCopyA
SetupCloseFileQueue
SetupCopyErrorA
SetupOpenInfFileA

user32

SetWindowLongA
MessageBoxA
LoadStringA
SendMessageA
GetDlgItem
PostMessageA
CheckRadioButton
SetFocus
PostQuitMessage
EnableWindow
SetDlgItemTextA
EndDialog
GetParent
SetForegroundWindow
SetWindowTextA
DialogBoxParamA

ntdll

RtlCharToInteger
NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
RtlTimeToTimeFields
_allshl
_stricmp
_strlwr
_aullshr
_allmul
strrchr
strchr
strcspn
sprintf
NtQuerySystemTime
_chkstk
strstr
RtlUnwind
_strnicmp
strncmp
_strupr
strtoul
strncpy

imagehlp

CheckSumMappedFile

wintrust

CryptCATGetCatAttrInfo
CryptCATOpen
CryptCATClose

mpr

WNetGetUserA

clusapi

GetNodeClusterState

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameA

newdev

UpdateDriverForPlugAndPlayDevicesA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

advapi32

InitiateSystemShutdownA
OpenSCManagerA
RegEnumKeyA
AdjustTokenPrivileges
RegFlushKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
StartServiceA
OpenServiceA
QueryServiceStatus
ControlService
CloseServiceHandle
RegEnumKeyExA
RegQueryInfoKeyA
RegSaveKeyA
RegCreateKeyExA
RegRestoreKeyA
RegDeleteValueA
AllocateAndInitializeSid
RegDeleteKeyA
RegSetValueExA
SetFileSecurityW
SetFileSecurityA
GetFileSecurityA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
InitializeAcl
OpenProcessToken
GetTokenInformation
GetLengthSid
InitializeSecurityDescriptor
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid

kernel32

SetEnvironmentVariableA
HeapReAlloc
GetTimeZoneInformation
GetStringTypeW
CompareStringW
CompareStringA
GetStringTypeA
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetOEMCP
LCMapStringW
LCMapStringA
WideCharToMultiByte
GetACP
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
HeapFree
HeapAlloc
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
OpenProcess
CreateRemoteThread
VirtualAllocEx
GetCPInfo
GetEnvironmentStringsW
WriteProcessMemory
CreateProcessA
GetExitCodeProcess
GetPrivateProfileStringA
FindClose
LocalFree
SetEvent
MoveFileExA
CreateThread
GetSystemDefaultUILanguage
SetFileAttributesW
FlushFileBuffers
CopyFileA
DeleteFileA
OpenFile
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FindNextFileA
GetDiskFreeSpaceA
OpenEventA
Sleep
MultiByteToWideChar
GetFullPathNameA
VirtualAlloc
WriteFile
VirtualFree
GetSystemDirectoryA
SetLastError
GetVersionExA
CreateEventA
FormatMessageA
GetModuleFileNameA
WaitForSingleObject
GetCurrentProcess
LoadLibraryA
GetProcAddress
FreeLibrary
ExpandEnvironmentStringsA
RemoveDirectoryA
CreateDirectoryA
SetFileAttributesA
DeviceIoControl
GetWindowsDirectoryA
CreateFileA
LocalAlloc
GetFileSize
ReadFile
CloseHandle
GetFileAttributesA
lstrlenA
FindFirstFileA
ExitProcess
GetLastError

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eea9698e432263efe771437768a3ce5b

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

setupapi

user32

ntdll

imagehlp

wintrust

mpr

clusapi

psapi

newdev

version

advapi32

kernel32

Sections

.text Size: 70KB - Virtual size: 70KB

.data Size: 10KB - Virtual size: 150KB

.rsrc Size: 23KB - Virtual size: 24KB

.text
Size: 70KB - Virtual size: 70KB

.data
Size: 10KB - Virtual size: 150KB

.rsrc
Size: 23KB - Virtual size: 24KB