6dffd2ba56e8160632f9f3359cd9c0d0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

6dffd2ba56e8160632f9f3359cd9c0d0N.exe
Size

479KB
MD5

6dffd2ba56e8160632f9f3359cd9c0d0
SHA1

11f5d6e20271a0b46dd724e9bdd513a46e72f988
SHA256

0fd075da1398713e5bfee6ffd9f020729ae7ad1cde0fafd403e5de80e876475b
SHA512

94cbd359142eb64f58acdcb9cbdf0f85ad7c77710c53941d675109b365c65f379f255e91f1ddb54e8c44393818b15905b4b973384d7a5441f183b3a10f2308cd
SSDEEP

12288:bBEZEXGVnU4Zde8OdWFEtQROb0L4srLKB4+KaR:xGVPe8OdWFEtQRZxLKTKa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6dffd2ba56e8160632f9f3359cd9c0d0N.exe

Files

6dffd2ba56e8160632f9f3359cd9c0d0N.exe
.dll regsvr32 windows:5 windows x86 arch:x86

712833b524230054a9cfaddffd13d8fe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\web\inst.vtgsrv.com\minibuild\stage_9788\IE\JigsawIEBho\Release\jigsaw.pdb

Imports

iphlpapi

GetAdaptersInfo

wininet

InternetReadFile
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpAddRequestHeadersA
HttpSendRequestW
HttpSendRequestA
InternetCloseHandle
InternetCrackUrlW

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

kernel32

SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
ResetEvent
WaitForMultipleObjects
SetEvent
CloseHandle
TerminateThread
Sleep
CreateThread
CreateEventW
RaiseException
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
LoadLibraryExW
SetThreadLocale
GetThreadLocale
InitializeCriticalSectionAndSpinCount
FlushInstructionCache
GetCurrentProcess
lstrlenA
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SetLastError
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
CreateMutexW
OpenMutexW
ReleaseMutex
GetVersionExW
LoadLibraryW
DeviceIoControl
FlushFileBuffers
WriteFile
SetFilePointer
CreateFileW
LocalFree
LocalAlloc
GetOEMCP
GetACP
GetStdHandle
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadFile
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
LCMapStringW
GetCPInfo
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
GetModuleFileNameA
GetStartupInfoW
GetFileType
GetCommandLineA
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
GetStringTypeW
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
SetHandleCount
GetLocaleInfoW
IsValidCodePage

user32

UnregisterClassA
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DefWindowProcW
SetTimer
CallWindowProcW
GetWindowLongW
SetWindowLongW
CharNextW

advapi32

RegCreateKeyExW
RegDeleteKeyW
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
CLSIDFromProgID
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
SysStringLen
SysReAllocStringLen
VarBstrCat
DispCallFunc
SysAllocStringLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
VarBstrCmp

shlwapi

SHSetValueW
SHGetValueW
StrToIntExA

urlmon

ObtainUserAgentString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

712833b524230054a9cfaddffd13d8fe

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

wininet

rpcrt4

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

Exports

Exports

Sections

.text Size: 251KB - Virtual size: 251KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 9KB - Virtual size: 17KB

.rsrc Size: 135KB - Virtual size: 135KB

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 251KB - Virtual size: 251KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 9KB - Virtual size: 17KB

.rsrc
Size: 135KB - Virtual size: 135KB

.reloc
Size: 18KB - Virtual size: 17KB