297ab7c3aa8c9a84cc134372773f41e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

297ab7c3aa8c9a84cc134372773f41e0N.exe
Size

399KB
MD5

297ab7c3aa8c9a84cc134372773f41e0
SHA1

58371c58e20e8179161f58eaa66e8f6ec456f415
SHA256

5ed7b55c142c3d19a06b4e2d1b3135c87c6e308076bdee0f1e1964f391f3c53d
SHA512

131e69ef91e97e15b839b7a4593128212782277edea54e67a451079e2134d027eda7a8f09b797487a32c660c8e2a95d5460036bd9827b53e760262b11bbe86ea
SSDEEP

3072:NjwczGLGyWl6/uZk2y+aR/pf7IGbPf+FuAEc20jZOKrZKiLNmABWbLY1RMM4yx9S:NsKhaF2k9L+/XjZOpiqDnrsTr1hFRc7P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
297ab7c3aa8c9a84cc134372773f41e0N.exe

Files

297ab7c3aa8c9a84cc134372773f41e0N.exe
.exe windows:4 windows x64 arch:x64

ea955d8cbfc6c7758fbcdea503206f6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetModuleFileNameExA

kernel32

GetModuleHandleA
GetVersionExA
SetStdHandle
GetStdHandle
LoadLibraryW
FreeLibrary
GetLastError
SetEvent
WaitForSingleObject
CreateEventA
Process32Next
OpenProcess
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
MulDiv
GlobalFree
GlobalAlloc
Sleep
GlobalUnlock
GlobalLock
GlobalMemoryStatus
GetFileAttributesA
SetPriorityClass
GetCurrentProcess
VirtualAlloc
VirtualFree
SetEndOfFile
GetProcAddress
HeapReAlloc
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapSize
RtlLookupFunctionEntry
RtlVirtualUnwind
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
InitializeCriticalSection
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
AllocConsole
OutputDebugStringA
WriteFile
FlushFileBuffers
GetLocalTime
MoveFileA
SetFilePointer
CreateFileA
GetFileSize
ReadFile
CloseHandle
SizeofResource
LoadLibraryA
SetEnvironmentVariableA
FindResourceA
LoadResource
LockResource
ExpandEnvironmentStringsA
lstrlenA
GetCommandLineA
CreateThread
GetModuleFileNameA
GetCurrentDirectoryA
SetCurrentDirectoryA
lstrcatA
lstrcpyA
GetFullPathNameA
FindFirstFileA
FindNextFileA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
DeleteCriticalSection
GetFileType
SetHandleCount
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
HeapSetInformation
HeapCreate
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection

user32

SetForegroundWindow
DefWindowProcA
MessageBoxA
PeekMessageA
DestroyWindow
GetSystemMetrics
ShowWindow
UpdateWindow
InvalidateRect
GetDC
CopyImage
BeginPaint
EndPaint
EnumWindows
DdeUninitialize
GetWindowInfo
GetWindowThreadProcessId
DdeConnect
DdeClientTransaction
CreateWindowExA
TranslateMessage
DispatchMessageA
GetMessageA
DdeInitializeA
DdeCreateStringHandleA
DdeNameService
DdeGetData
LoadCursorA
RegisterClassExA
DdeFreeStringHandle

gdi32

GetObjectA
GetDeviceCaps
CreateFontA
DeleteObject
SelectObject
BitBlt
DeleteDC
SetBkMode
SetBkColor
SetTextColor
TextOutA
GetStockObject
CreateCompatibleDC

advapi32

RegCloseKey
RegEnumKeyExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegOpenKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA

ole32

CoUninitialize
CreateStreamOnHGlobal
CoInitialize

Exports

Exports

DDE_Ready
INI_GetDictionary
INI_GetProperty
Log_LogIt
SplashScreen_Close
SplashScreen_GetWindowHandle
SplashScreen_SetText
SplashScreen_SetTextBgColor
SplashScreen_SetTextColor
SplashScreen_SetTextFont

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea955d8cbfc6c7758fbcdea503206f6b

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

gdi32

advapi32

ole32

Exports

Exports

Sections

.text Size: 121KB - Virtual size: 121KB

.rdata Size: 29KB - Virtual size: 28KB

.data Size: 72KB - Virtual size: 89KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 170KB - Virtual size: 169KB

.text
Size: 121KB - Virtual size: 121KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 72KB - Virtual size: 89KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 170KB - Virtual size: 169KB