34a004eac66dd684dd18a19da26018e9360e832ece7f7be4258d20616ef110c4[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

34a004eac66dd684dd18a19da26018e9360e832ece7f7be4258d20616ef110c4.exe
Size

1.1MB
MD5

887f724d1a862702716a4d0a3f7bb4bb
SHA1

d999a66e8f82342f792a6800e1a30040c5e8b362
SHA256

34a004eac66dd684dd18a19da26018e9360e832ece7f7be4258d20616ef110c4
SHA512

879dd56151b0d6a971696430530e54476d1bd7ced2f95f0b43986aee1837e3dd3bf970171f9197e156bf5c0adb1f44189eb8250c2fd2d3244b612bdb8eea7022
SSDEEP

24576:4yVlmm8PXkQunEY5PGKTU1WmAGPGvRmKuw:5FyAbaw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34a004eac66dd684dd18a19da26018e9360e832ece7f7be4258d20616ef110c4.exe

Files

34a004eac66dd684dd18a19da26018e9360e832ece7f7be4258d20616ef110c4.exe
.exe windows:4 windows x86 arch:x86

b7fe74c1f84e1cff34de38d0403d75d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetLastError
CreateMutexA
CreateProcessA
UnmapViewOfFile
WideCharToMultiByte
CreateFileA
FlushViewOfFile
OpenFileMappingA
GetACP
IsDBCSLeadByte
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SetFilePointer
LoadLibraryA
GetProcAddress
GetVersionExA
ReadFile
WriteFile
TerminateProcess
OpenMutexA
CloseHandle
GetProfileStringA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateFileMappingA
MapViewOfFile
GetTimeZoneInformation
TlsGetValue
SetLastError
TlsAlloc
GetCurrentThreadId
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
ExitThread
TlsSetValue
ResumeThread
GetLocalTime
GetSystemTime
DeleteFileA
CreateDirectoryA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
HeapSize
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
InterlockedIncrement
InterlockedExchange
Sleep
CreateThread
GetStringTypeA
GetTickCount
IsBadWritePtr
GetFullPathNameA
GetCurrentDirectoryA
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
SetEnvironmentVariableA
GetStringTypeW
SetStdHandle
GetOEMCP
FlushFileBuffers
GetFileAttributesA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
OutputDebugStringA
GlobalMemoryStatus
InterlockedDecrement
GetDiskFreeSpaceA
GetDriveTypeA
SetEndOfFile
CompareStringA
GetLogicalDriveStringsA
GetSystemInfo
CompareStringW

user32

MapVirtualKeyA
SetFocus
GetKeyState
GetAsyncKeyState
GetDesktopWindow
GetDC
ReleaseDC
PeekMessageA
DefWindowProcA
GetKeyNameTextA
GetDoubleClickTime
GetCursorPos
MessageBoxA
FindWindowA
RegisterClassA
UpdateWindow
CreateWindowExA
LoadCursorA
LoadMenuA
GetMessageA
ScreenToClient
GetFocus
SetCapture
ReleaseCapture
GetActiveWindow
DefWindowProcW
SetMenu
AdjustWindowRectEx
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClassW
CreateWindowExW
GetWindowDC
DestroyMenu
ShowCursor
BeginPaint
EndPaint
GetWindowRect
SetWindowPos
SetCursor
ClientToScreen
PostQuitMessage
GetWindowLongA
SetWindowLongA
LoadIconA
GetSystemMetrics
TranslateMessage
TranslateAcceleratorA
DispatchMessageA
LoadAcceleratorsA
SetWindowTextA
InvalidateRect
GetMenu
CheckMenuItem
GetWindowPlacement
GetClientRect
SendMessageA
ShowWindow
IsZoomed

gdi32

DeleteDC
CreatePalette
GetDeviceCaps
DeleteObject
SelectObject
SelectPalette
CreateCompatibleDC
BitBlt
RealizePalette
CreateDIBSection

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

wsock32

select
__WSAFDIsSet
gethostname
send
WSAGetLastError
bind
sendto
recvfrom
htonl
htons
socket
setsockopt
connect
inet_ntoa
recv
ntohs
closesocket
WSAStartup
gethostbyname
WSACleanup
ntohl

comctl32

ord17

ddraw

DirectDrawCreate

dsound

ord1

winmm

mmioRead
timeSetEvent
timeKillEvent
mciSendCommandA
midiOutSetVolume
midiOutGetDevCapsA
midiOutGetVolume
mmioClose
mmioOpenA
mmioSetBuffer
mmioSeek

Sections

.text
Size: 920KB - Virtual size: 918KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 8.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UVA_DATA
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7fe74c1f84e1cff34de38d0403d75d2

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

wsock32

comctl32

ddraw

dsound

winmm

Sections

.text Size: 920KB - Virtual size: 918KB

.rdata Size: 80KB - Virtual size: 76KB

.data Size: 108KB - Virtual size: 8.1MB

UVA_DATA Size: 16KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 920KB - Virtual size: 918KB

.rdata
Size: 80KB - Virtual size: 76KB

.data
Size: 108KB - Virtual size: 8.1MB

UVA_DATA
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 3KB