c720d5c369b8ce4b30df156aa4f68ff0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c720d5c369b8ce4b30df156aa4f68ff0N.exe
Size

923KB
MD5

c720d5c369b8ce4b30df156aa4f68ff0
SHA1

ddf8b01159296204a7e67b3cea9ef7af50f5acde
SHA256

253b76e74362560427f31f1e97b2c200d1ce10f6beba5e755be02a5765a97636
SHA512

3ec17ff6d8362a63bd227db2356a816f0d1c41b601462d73d9bff803ba11ab073f11e7c03f9249023b1d83c80137377ca9398b2030390d3c0d83bc9798a30b40
SSDEEP

24576:mM+dje6X14gSYJJaYO89h1tY3BIKUcwYzcakGLC23+c:mr91dJJaYO8NtQOYzKGLC4p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c720d5c369b8ce4b30df156aa4f68ff0N.exe

Files

c720d5c369b8ce4b30df156aa4f68ff0N.exe
.exe windows:5 windows x86 arch:x86

705958c97a1937f706c668a1c21fefdb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

M:\TWRK\84162e5da40d452f\src\MicrogamingInstall\Release\MicrogamingInstall.pdb

Imports

kernel32

lstrcpyA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WideCharToMultiByte
OutputDebugStringA
CreateProcessW
WaitForSingleObject
OpenProcess
Sleep
CreateProcessA
lstrcmpiA
RemoveDirectoryA
CopyFileA
GetTempFileNameA
GetCurrentProcessId
GetTempPathA
DeleteFileA
GetComputerNameA
FormatMessageA
GetVolumePathNameW
CopyFileW
FormatMessageW
RemoveDirectoryW
GetModuleHandleA
ReleaseMutex
GetDiskFreeSpaceExA
GetVersionExA
DeleteFileW
SetFileAttributesW
SetEvent
GetPrivateProfileStringW
CreateEventA
LoadLibraryA
CreateMutexA
GetDriveTypeA
GetVolumeInformationA
DeviceIoControl
ResetEvent
InterlockedDecrement
MoveFileExA
Process32First
TerminateProcess
GetSystemDirectoryA
GetLocalTime
Process32Next
CreateToolhelp32Snapshot
InterlockedIncrement
GetPrivateProfileIntA
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
GetCurrentThreadId
CreateThread
CreateSemaphoreA
ReleaseSemaphore
GetLogicalDriveStringsA
GlobalMemoryStatusEx
GetSystemInfo
GetEnvironmentVariableA
SetThreadPriority
GetCurrentThread
GetThreadTimes
ResumeThread
InterlockedCompareExchange
QueueUserWorkItem
OpenFileMappingA
lstrcatA
CompareStringW
GetProcessHeap
SetEndOfFile
SetStdHandle
GetStringTypeW
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
LCMapStringW
GetTimeZoneInformation
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapCreate
GetStdHandle
GetFileType
WriteConsoleW
MoveFileA
RaiseException
RtlUnwind
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetStartupInfoW
HeapSetInformation
FindNextFileA
GetModuleFileNameA
FindClose
FindFirstFileA
CreateDirectoryA
lstrlenW
GetFileAttributesW
GetModuleFileNameW
lstrcpynW
GetFileAttributesA
lstrcpynA
CreateFileA
lstrlenA
GetFileSize
LocalFree
GetProcAddress
MultiByteToWideChar
CreateFileW
LoadLibraryW
CreateDirectoryW
FreeLibrary
CloseHandle
GetLastError
ReadFile
WriteFile
SetFilePointer
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleW
EncodePointer
DecodePointer
HeapAlloc
HeapFree
SetFileAttributesA

user32

PostMessageA
RegisterClassA
ShowWindow
DefWindowProcA
CreateWindowExA
FlashWindowEx
MoveWindow
DefWindowProcW
SetWindowTextA
LoadCursorA
AdjustWindowRect
EnableWindow
UpdateWindow
MapWindowPoints
LoadImageA
IsWindowVisible
GetSystemMetrics
RegisterClassW
MessageBoxW
MessageBoxA
SetFocus
CopyRect
wsprintfW
InvalidateRect
GetDlgCtrlID
GetActiveWindow
DispatchMessageA
CreateWindowExW
CreatePopupMenu
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
SetWindowLongW
ReleaseDC
PeekMessageA
AppendMenuW
GetWindowLongW
SetWindowLongA
OffsetRect
ChildWindowFromPoint
TranslateMessage
IsDialogMessageA
SendMessageA
GetClientRect
IsWindowEnabled
LoadIconA
SetForegroundWindow
PostThreadMessageA
wsprintfA
wvsprintfA
SendMessageTimeoutA
DestroyWindow
GetMessageA
GetWindowRect
TrackPopupMenu
GetWindowDC

gdi32

DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
GetStockObject
BitBlt

advapi32

RegQueryValueExA
RegEnumKeyW
OpenSCManagerA
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueW
RegSetValueA
RegQueryValueW
RegCloseKey
GetUserNameA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
FreeSid
SetEntriesInAclW

shell32

Shell_NotifyIconA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListW
SHGetFolderPathW
SHGetMalloc
SHChangeNotify
SHGetSpecialFolderPathA

ole32

OleInitialize
OleCreate
OleSetContainedObject
StringFromIID
OleUninitialize
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize
CoInitialize
CoTaskMemFree
CLSIDFromProgID

oleaut32

VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysStringLen
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
SafeArrayCreateVector

wsock32

gethostbyname
gethostbyaddr
inet_addr
ioctlsocket
WSACleanup
htonl
WSAGetLastError
htons
ntohs
getservbyport
getservbyname
WSASetLastError
WSAStartup

wininet

InternetCreateUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetConnectA
InternetGetLastResponseInfoA
InternetCrackUrlW
HttpSendRequestA
HttpQueryInfoA
InternetOpenUrlA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA

shlwapi

PathAppendA
SHDeleteKeyA
PathCanonicalizeW
PathAppendW
StrStrA
PathCanonicalizeA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

WSAAddressToStringA

urlmon

CoInternetGetSession

Exports

Exports

?CreateDefaultBrowserInfo@@YGPAVIDefaultBrowserInfo@@XZ
?CreateDirectXVersionInfo@@YGPAVIDirectXVersionInfo@@XZ
?CreateDisplaysDeviceInfo@@YGPAVIDisplayDevicesInfo@@XZ
?CreateFixedDriveInfo@@YGPAVIFixedDriveInfo@@XZ
?CreateFixedDrivesInfo@@YGPAVIFixedDrivesInfo@@XZ
?CreateFlashInfo@@YGPAVIFlashInfo@@XZ
?CreateIEVersionInfo@@YGPAVIIEVersionInfo@@XZ
?CreateMacAddress@@YGPAVIMacAddress@@XZ
?CreateMachineInfo@@YGPAVIMachineInfo@@XZ
?CreateMachineInfoXML@@YGPAVIMachineInfoXML@@XZ
?CreateOSInfo@@YGPAVIOSInfo@@XZ
?CreateProcessorsInfo@@YGPAVIProcessorsInfo@@XZ
?CreateRamInfo@@YGPAVIRamInfo@@XZ
?CreateSoundDevicesInfo@@YGPAVISoundDevicesInfo@@XZ
?CreateUserExperience@@YGPAVIUserExperience@@XZ
?CreateVMInfo@@YGPAVIVMInfo@@XZ

Sections

.text
Size: 419KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

705958c97a1937f706c668a1c21fefdb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

wininet

shlwapi

psapi

version

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 419KB - Virtual size: 418KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 80KB - Virtual size: 99KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 419KB - Virtual size: 418KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 80KB - Virtual size: 99KB

.rsrc
Size: 4KB - Virtual size: 3KB