d7208b40d9469f6b2a356a883d201110N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

d7208b40d9469f6b2a356a883d201110N.exe
Size

951KB
MD5

d7208b40d9469f6b2a356a883d201110
SHA1

57747df60a7b665890eca56c71f942243127c670
SHA256

0fe1b9176d6f933e1f1949a5ce1fa4b88d342e2552ff3362ddc966917f4f1a32
SHA512

86f328b58c4c1c14d5045fda77914ed0509159019c5d75d8a154a7b36330162441391bd1bec8eb68bc54112c808a30908623fa0c7d78dddc7ea6acffd6c2b404
SSDEEP

24576:JsvVZKzGFi3LmZPgDcny89cWIzV5Yzwz9QaRL2vqaT:JstW3aPgDo2Yz8QaRSHT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7208b40d9469f6b2a356a883d201110N.exe

Files

d7208b40d9469f6b2a356a883d201110N.exe
.exe windows:5 windows x86 arch:x86

368908feefa0aa1ba4668affa866b84d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

M:\TWRK\a234a9b605bf94fa\src\MicrogamingInstall\Release\MicrogamingInstall.pdb

Imports

kernel32

MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WideCharToMultiByte
OutputDebugStringA
CreateProcessW
WaitForSingleObject
OpenProcess
Sleep
CreateProcessA
lstrcmpiA
RemoveDirectoryA
CopyFileA
GetTempFileNameA
GetCurrentProcessId
GetTempPathA
DeleteFileA
GetComputerNameA
FormatMessageA
GetVolumePathNameW
CopyFileW
FormatMessageW
RemoveDirectoryW
GetModuleHandleA
ReleaseMutex
GetDiskFreeSpaceExA
GetVersionExA
DeleteFileW
SetFileAttributesW
SetEvent
GetPrivateProfileStringW
CreateEventA
LoadLibraryA
CreateMutexA
GetDriveTypeA
GetVolumeInformationA
DeviceIoControl
InterlockedDecrement
MoveFileExA
Process32First
TerminateProcess
GetSystemDirectoryA
GetLocalTime
Process32Next
CreateToolhelp32Snapshot
InterlockedIncrement
GetPrivateProfileIntA
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
GetCurrentThreadId
CreateThread
CreateSemaphoreA
ReleaseSemaphore
GetLogicalDriveStringsA
GlobalMemoryStatusEx
GetSystemInfo
GetEnvironmentVariableA
SetThreadPriority
GetCurrentThread
lstrcpyA
ResumeThread
InterlockedCompareExchange
QueueUserWorkItem
OpenFileMappingA
lstrcatA
CompareStringW
GetProcessHeap
SetEndOfFile
SetStdHandle
GetStringTypeW
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
LCMapStringW
GetTimeZoneInformation
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapCreate
GetStdHandle
GetFileType
WriteConsoleW
MoveFileA
RaiseException
RtlUnwind
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetStartupInfoW
HeapSetInformation
FindNextFileA
GetModuleFileNameA
FindClose
FindFirstFileA
CreateDirectoryA
GetModuleFileNameW
lstrlenW
GetFileAttributesW
lstrcpynW
GetFileAttributesA
lstrcpynA
CreateFileA
lstrlenA
GetFileSize
LocalFree
GetProcAddress
MultiByteToWideChar
CreateFileW
LoadLibraryW
CreateDirectoryW
FreeLibrary
CloseHandle
GetLastError
ReadFile
WriteFile
SetFilePointer
GetThreadTimes
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleW
EncodePointer
DecodePointer
HeapAlloc
HeapFree
SetFileAttributesA

user32

PostMessageA
RegisterClassA
ShowWindow
DefWindowProcA
CreateWindowExA
FlashWindowEx
MoveWindow
DefWindowProcW
SetWindowTextA
LoadCursorA
AdjustWindowRect
EnableWindow
UpdateWindow
MapWindowPoints
LoadImageA
IsWindowVisible
GetSystemMetrics
RegisterClassW
MessageBoxW
MessageBoxA
SetFocus
CopyRect
wsprintfW
InvalidateRect
GetDlgCtrlID
GetActiveWindow
DispatchMessageA
CreateWindowExW
CreatePopupMenu
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
SetWindowLongW
ReleaseDC
PeekMessageA
AppendMenuW
GetWindowLongW
SetWindowLongA
OffsetRect
ChildWindowFromPoint
TranslateMessage
IsDialogMessageA
SendMessageA
GetClientRect
IsWindowEnabled
LoadIconA
SetForegroundWindow
PostThreadMessageA
wsprintfA
wvsprintfA
SendMessageTimeoutA
DestroyWindow
GetMessageA
GetWindowRect
TrackPopupMenu
GetWindowDC

gdi32

DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
GetStockObject
BitBlt

advapi32

RegCreateKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyW
OpenSCManagerA
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegQueryValueExW
RegSetValueW
RegSetValueA
RegQueryValueW
RegCloseKey
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
FreeSid
SetEntriesInAclW

shell32

Shell_NotifyIconA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListW
SHGetFolderPathW
SHGetMalloc
SHChangeNotify
SHGetSpecialFolderPathA

ole32

OleInitialize
OleCreate
OleSetContainedObject
StringFromIID
OleUninitialize
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize
CoInitialize
CoTaskMemFree
CLSIDFromProgID

oleaut32

VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysStringLen
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
SafeArrayCreateVector

wsock32

gethostbyname
gethostbyaddr
inet_addr
ioctlsocket
WSACleanup
htonl
WSAGetLastError
htons
ntohs
getservbyport
getservbyname
WSASetLastError
WSAStartup

wininet

InternetCreateUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetConnectA
InternetGetLastResponseInfoA
InternetCrackUrlW
HttpSendRequestA
HttpQueryInfoA
InternetOpenUrlA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA

shlwapi

PathAppendA
SHDeleteKeyA
PathCanonicalizeW
PathAppendW
StrStrA
PathCanonicalizeA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

WSAAddressToStringA

urlmon

CoInternetGetSession

Exports

Exports

?CreateDefaultBrowserInfo@@YGPAVIDefaultBrowserInfo@@XZ
?CreateDirectXVersionInfo@@YGPAVIDirectXVersionInfo@@XZ
?CreateDisplaysDeviceInfo@@YGPAVIDisplayDevicesInfo@@XZ
?CreateFixedDriveInfo@@YGPAVIFixedDriveInfo@@XZ
?CreateFixedDrivesInfo@@YGPAVIFixedDrivesInfo@@XZ
?CreateFlashInfo@@YGPAVIFlashInfo@@XZ
?CreateIEVersionInfo@@YGPAVIIEVersionInfo@@XZ
?CreateMacAddress@@YGPAVIMacAddress@@XZ
?CreateMachineInfo@@YGPAVIMachineInfo@@XZ
?CreateMachineInfoXML@@YGPAVIMachineInfoXML@@XZ
?CreateOSInfo@@YGPAVIOSInfo@@XZ
?CreateProcessorsInfo@@YGPAVIProcessorsInfo@@XZ
?CreateRamInfo@@YGPAVIRamInfo@@XZ
?CreateSoundDevicesInfo@@YGPAVISoundDevicesInfo@@XZ
?CreateUserExperience@@YGPAVIUserExperience@@XZ
?CreateVMInfo@@YGPAVIVMInfo@@XZ

Sections

.text
Size: 414KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

368908feefa0aa1ba4668affa866b84d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

wininet

shlwapi

psapi

version

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 414KB - Virtual size: 413KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 75KB - Virtual size: 93KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 414KB - Virtual size: 413KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 75KB - Virtual size: 93KB

.rsrc
Size: 4KB - Virtual size: 3KB