b605da4c864fffeed41bc0081df21180N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b605da4c864fffeed41bc0081df21180N.exe
Size

2.7MB
MD5

b605da4c864fffeed41bc0081df21180
SHA1

ae9ebb6a01789b5754537cb8a08575bf837fe411
SHA256

a7b08fb04331cea4cb69a72959a77dc2f99b896d37691c590cb3ceaefb00ce00
SHA512

d66db746282920f01e31be1324ca9f7a3c4cbf2b6d664c97ebf322e79e07913d6ef2dd38f8c73a26b2559ad1771b829f37b5e68ca79e63398450cb77b0e54254
SSDEEP

49152:lqN06qoHW6mu6RDcdpN8sMSXZttfcOoB6j4hMC5BYMdefVU:lEqvs6ydpFMS/tUO+PmV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b605da4c864fffeed41bc0081df21180N.exe

Files

b605da4c864fffeed41bc0081df21180N.exe
.exe windows:6 windows x86 arch:x86

ec1705b6ad330f25047022c193a20ab8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualQueryEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemTimeAsFileTime
CreateProcessW
CopyFileW
SetEndOfFile
GetDateFormatW
GetModuleHandleW
CreateThread
SetEvent
Sleep
CreateEventW
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetVersionExW
GetProcessHeap
MapViewOfFile
CreateFileMappingW
DecodePointer
WriteConsoleW
HeapSize
GetTimeZoneInformation
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
SystemTimeToFileTime
ReadProcessMemory
SetStdHandle
GetConsoleOutputCP
FlushFileBuffers
LCMapStringW
CompareStringW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
GetCommandLineW
GetCommandLineA
LoadLibraryExW
EncodePointer
RaiseException
FindResourceW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryA
FreeLibrary
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
VirtualAlloc
TerminateProcess
K32GetProcessImageFileNameW
GetVersionExA
ExpandEnvironmentStringsA
GetComputerNameA
GetCurrentThreadId
ExitProcess
IsDebuggerPresent
GetSystemTime
GetFullPathNameW
GetCurrentProcessId
DuplicateHandle
OpenProcess
OpenFileMappingW
GetLongPathNameW
SizeofResource
LockResource
GetCurrentDirectoryW
GetSystemInfo
GetFileSizeEx
MoveFileExW
GetFileSize
GetFileInformationByHandle
HeapAlloc
SetFilePointer
GetTickCount
GetProcAddress
LoadLibraryW
SetFilePointerEx
CompareFileTime
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
GetFileAttributesW
DeleteFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
WriteFile
CloseHandle
UnmapViewOfFile
WideCharToMultiByte
GetLocalTime
OutputDebugStringW
MultiByteToWideChar
CreateFileW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadFile
GetLastError
HeapFree
DeleteFiber
SwitchToFiber
QueryPerformanceCounter
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetFileType
GetEnvironmentVariableW
GetStdHandle
LoadResource
SetFileAttributesW
FormatMessageW
GetSystemDirectoryW
GetTempPathW
GetComputerNameW
GetDriveTypeW
RtlUnwind
GetLogicalDrives
SetLastError
HeapReAlloc
FindFirstFileExW

user32

ReleaseDC
SetWindowPos
LoadIconW
SetWindowTextW
GetClientRect
LoadImageW
ClientToScreen
GetParent
SetWindowLongW
SetClassLongW
GetWindowLongW
GetFocus
GetWindowThreadProcessId
PostMessageW
DrawTextExW
KillTimer
ShowWindow
GetProcessWindowStation
GetUserObjectInformationW
DialogBoxParamW
EndDialog
EnumWindows
CharUpperA
GetDC
GetDlgItem
GetWindowTextW
GetClassNameW
CharLowerBuffW
MessageBoxW
IsCharAlphaNumericW
SetFocus
GetWindowRect
CharUpperBuffW
SystemParametersInfoW
IsCharAlphaW
SetDlgItemTextW
GetDlgCtrlID
MoveWindow
FindWindowW
CheckDlgButton
CreateCursor
LoadCursorW
FillRect
GetWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsWindow
GetDesktopWindow
GetAsyncKeyState
EnableWindow
GetSystemMetrics
GetWindowTextLengthW
SetTimer
IsDlgButtonChecked
InvalidateRect
CallWindowProcW
DestroyIcon
SetCursor
LoadStringW
IsWindowVisible
GetDlgItemTextW
SendMessageW

gdi32

SetBkMode
TextOutW
SetTextColor
GetStockObject
GetTextExtentPoint32W
DeleteObject
GetObjectW
SelectObject
CreateFontIndirectW
GetDeviceCaps

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

GetUserNameW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CloseEventLog
ReadEventLogW
OpenEventLogW
CryptAcquireContextW
RegQueryValueExA
GetUserNameA
GetCurrentHwProfileW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegDeleteValueW
GetTokenInformation
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
DuplicateToken
OpenProcessToken
OpenThreadToken
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
CryptDecrypt
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptEnumProvidersW

shell32

SHBrowseForFolderW
DragAcceptFiles
DragQueryFileW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathA
SHGetPathFromIDListW
SHGetFileInfoW
SHGetMalloc
SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CLSIDFromProgID
CoGetClassObject
CoInitialize

oleaut32

SysFreeString
SysAllocString

ntdll

NtEnumerateValueKey
NtSetInformationFile

comctl32

PropertySheetW
ord17
CreatePropertySheetPageW

shlwapi

PathFindFileNameW

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore

ws2_32

socket
setsockopt
connect
closesocket
WSASetLastError
send
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
ntohs
getsockopt
ioctlsocket
shutdown

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gcode
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 596KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 159KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec1705b6ad330f25047022c193a20ab8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ntdll

comctl32

shlwapi

crypt32

ws2_32

version

mpr

bcrypt

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.gcode Size: 5KB - Virtual size: 4KB

.rdata Size: 596KB - Virtual size: 596KB

.data Size: 159KB - Virtual size: 176KB

.gdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 288KB - Virtual size: 287KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.gcode
Size: 5KB - Virtual size: 4KB

.rdata
Size: 596KB - Virtual size: 596KB

.data
Size: 159KB - Virtual size: 176KB

.gdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 288KB - Virtual size: 287KB