87ee74f784f5c4e2b6bd61d4efdac5e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

87ee74f784f5c4e2b6bd61d4efdac5e0N.exe
Size

3.4MB
MD5

87ee74f784f5c4e2b6bd61d4efdac5e0
SHA1

6690a07a3ac3be3a4765cb2022d8c5cfecb70811
SHA256

e5a93563ffa32fafe7c9164ceb69cad092e474fea6e8c620e90d6a016ed4f3cd
SHA512

166bbf759f798cd0bdd8059517a1626d8cdb514bc3be31f17a4e4a3ddff213e7a6f4b7e4386238d2fef2467d53737555425a11c298349a0130577e875f16000e
SSDEEP

98304:ikXHlAt4DjIw1Jsv6tWKFdu9ClD0uJBNN0:iZw1Jsv6tWKFdu9ClIuJBn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87ee74f784f5c4e2b6bd61d4efdac5e0N.exe

Files

87ee74f784f5c4e2b6bd61d4efdac5e0N.exe
.exe windows:6 windows x86 arch:x86

b7287099a0b8c32585a18df929aeb222

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DefWindowProcW
SetWindowLongW
GetWindowLongW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
PostThreadMessageW
EnumWindows
GetWindowThreadProcessId
CharNextExA
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassW

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

UnhandledExceptionFilter
GetCPInfo
SetUnhandledExceptionFilter
CloseHandle
WaitForSingleObject
TerminateProcess
OpenProcess
GetTickCount
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLastError
CreateFileA
ReadFile
WriteFile
GetOverlappedResult
DeviceIoControl
CancelIo
ResetEvent
CreateEventW
FreeLibrary
GetProcAddress
LocalFree
FormatMessageW
LoadLibraryA
OutputDebugStringW
WaitForMultipleObjects
SetHandleInformation
LoadLibraryW
CompareStringW
GetUserDefaultLCID
GetCommandLineW
GetCurrentProcessId
DuplicateHandle
SetEvent
Sleep
GetCurrentProcess
SwitchToThread
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
GetSystemTime
GetLocalTime
GetConsoleWindow
GetStartupInfoW
GetModuleFileNameW
GetModuleHandleW
VerSetConditionMask
GetVersionExW
VerifyVersionInfoW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemDirectoryW
CreateFileW
SetLastError
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
GetFileType
GetLogicalDrives
SetEndOfFile
SetFilePointerEx
MoveFileExW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
GetLongPathNameW
RemoveDirectoryW
GetTempPathW
SetErrorMode
CopyFileW
MoveFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetExitCodeProcess
CreateProcessW
MultiByteToWideChar
WideCharToMultiByte
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultUILanguage
ReleaseSemaphore
CreateSemaphoreW
FindFirstFileExW
FindNextFileW
WriteConsoleW
GetModuleHandleA
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
CreateIoCompletionPort
PostQueuedCompletionStatus
ReleaseMutex
CreateMutexW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFileAttributesW
SetStdHandle
LoadLibraryExW
ExitThread
IsProcessorFeaturePresent
IsDebuggerPresent
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LCMapStringW
IsValidLocale
EnumSystemLocalesW
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
GetModuleFileNameA
GetSystemTimeAsFileTime
SetEnvironmentVariableA
GetFileAttributesExW
PeekNamedPipe
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
RaiseException
GetModuleHandleExW
ExitProcess
GetStringTypeW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
VirtualFree

shell32

ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree

advapi32

GetLengthSid
FreeSid
CopySid
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
GetTokenInformation

ws2_32

gethostbyname
gethostbyaddr
ntohl
inet_addr
getsockopt
htonl
getsockname
WSAGetLastError
select
setsockopt
WSAAsyncSelect
WSASocketW
WSASendTo
WSASend
WSARecvFrom
__WSAFDIsSet
bind
listen
closesocket
WSARecv
WSANtohs
WSANtohl
WSAIoctl
WSAHtons
WSAHtonl
WSAConnect
WSAAccept
WSACleanup
getpeername
WSAStartup

Exports

Exports

hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_feature_report
hid_get_indexed_string
hid_get_manufacturer_string
hid_get_product_string
hid_get_serial_number_string
hid_init
hid_is_valid
hid_open
hid_open_path
hid_open_v2
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_write
z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 624KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b7287099a0b8c32585a18df929aeb222

Headers

DLL Characteristics

File Characteristics

Imports

user32

setupapi

version

kernel32

shell32

ole32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 15KB - Virtual size: 42KB

.qtmetad Size: 1024B - Virtual size: 516B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 624KB - Virtual size: 628KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 15KB - Virtual size: 42KB

.qtmetad
Size: 1024B - Virtual size: 516B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 624KB - Virtual size: 628KB