496af59894a9aaf0bc365fbe972666f0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

496af59894a9aaf0bc365fbe972666f0N.exe
Size

2.0MB
MD5

496af59894a9aaf0bc365fbe972666f0
SHA1

25a318ee09168162bcb9679d73ba75c79cf0cf02
SHA256

2213f4c958e4696c87a87c3c87743cd901df26fa8bb613437f7aec86acedad04
SHA512

db25572557c2343028483056cf2d1a25ff68fdf56f1f956068b4e062ff71e4ca82e0615fb53d7f6f0fcae02e1a81a74c0b2b81fc5ee31e4ee04c994c989c81b6
SSDEEP

49152:yrOdEZrjWDNjCccUTS5kebuPv3SQg0fQZF7G4T1i:4WDNlcp1uPv3S6oZ9X1i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
496af59894a9aaf0bc365fbe972666f0N.exe

Files

496af59894a9aaf0bc365fbe972666f0N.exe
.exe windows:4 windows x86 arch:x86

82593b0fa62ddfd166e2c785c669a896

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
wcslen
wcscpy
wcsncpy
wcscat
wcschr
_wcsicmp
memcpy
malloc
free
strncmp
memmove
printf
wcscmp
memcmp
_stricmp
atoi
sprintf
strcpy
strlen
strcat
_wstat
_wcsdup
strcmp
wcsstr
tolower
wcsncmp
_snwprintf
floor
ceil
_wcsnicmp
_wtoi
_itow
localtime
mktime
gmtime
cos
fmod
sin
abs
fabs
fseek
ftell
fread
fclose
pow
??3@YAXPAX@Z
_isnan
srand
rand
realloc
calloc
_errno
strrchr
memchr
_lseeki64
abort
_close
_wopen
_setmode
exit
_open_osfhandle
strchr
_strdup
_snprintf
setlocale
wctomb
_get_osfhandle
_open
toupper
mbstowcs
_vsnwprintf

kernel32

GetModuleHandleW
HeapCreate
GetSystemDirectoryW
GetSystemWindowsDirectoryW
CreateSemaphoreW
GetLastError
CloseHandle
HeapDestroy
ExitProcess
GetVolumeNameForVolumeMountPointW
DeleteVolumeMountPointW
SetVolumeMountPointW
SetFilePointerEx
ReadFile
LoadLibraryW
FormatMessageW
FreeLibrary
GetLocalTime
GetCurrentProcess
DeviceIoControl
GetLogicalDriveStringsW
CreateFileW
GetDriveTypeW
QueryDosDeviceW
Sleep
GetTickCount
QueryPerformanceFrequency
QueryPerformanceCounter
WriteFile
FlushFileBuffers
GetUserDefaultLangID
GetVolumeInformationW
GetLogicalDrives
DefineDosDeviceW
SetEndOfFile
CreateProcessW
GetThreadContext
ReadProcessMemory
ResumeThread
SetThreadContext
TerminateProcess
VirtualAllocEx
WriteProcessMemory
HeapFree
HeapAlloc
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateThread
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
DuplicateHandle
CreatePipe
GetStdHandle
PeekNamedPipe
GetExitCodeProcess
GetFileSize
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
SetUnhandledExceptionFilter
TlsAlloc
TlsSetValue
TlsGetValue
GetVersionExW
GetSystemInfo
GlobalMemoryStatusEx
SetLastError
FindFirstFileW
FindClose
GetFileAttributesW
FindNextFileW
SetFileAttributesW
RemoveDirectoryW
CopyFileW
GetTempPathW
CreateDirectoryW
GlobalAlloc
GlobalFree
HeapSize
TlsFree
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
VirtualAlloc
VirtualFree
IsValidCodePage
GetACP
GetOEMCP
GetFileType
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

user32

EnableWindow
GetSystemMetrics
SendMessageW
UnhookWinEvent
GetWindowRect
GetCursorPos
PtInRect
KillTimer
SetTimer
GetWindowTextW
GetSysColor
GetWindowLongW
EnumChildWindows
LoadStringW
SetWinEventHook
MessageBoxW
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
EnumWindows
SetWindowPos
SetMenu
DestroyMenu
EnableMenuItem
DrawStateW
GetIconInfo
DrawIconEx
SystemParametersInfoW
DrawTextW
GetMenuItemCount
GetSubMenu
GetPropW
GetMenu
GetMenuItemInfoW
ModifyMenuW
SetMenuItemInfoW
GetDC
ReleaseDC
GetSysColorBrush
FillRect
FrameRect
CallWindowProcW
SetWindowLongW
SetPropW
AppendMenuW
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyWindow
GetWindowTextLengthW
SetWindowTextW
InvalidateRect
UpdateWindow
RedrawWindow
ReleaseCapture
BeginPaint
EndPaint
SetCapture
ScreenToClient
CreateWindowExW
SetRect
SetCursor
GetParent
GetClientRect
DefWindowProcW
GetMessagePos
LoadCursorW
ShowWindow
ValidateRect
MapWindowPoints
RemovePropW
GetKeyState
ClipCursor
SetFocus
ChildWindowFromPointEx
GetCapture
GetFocus
DrawFocusRect
RegisterClassExW
GetWindow
MoveWindow
DrawFrameControl
SetActiveWindow
DestroyIcon
LoadIconW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
RegisterClassW
AdjustWindowRectEx
CreateAcceleratorTableW
UnregisterClassW
IsZoomed
IsIconic
ClientToScreen
DefFrameProcW
DestroyAcceleratorTable
GetClassNameW
IsChild
RegisterWindowMessageW
EnumDisplaySettingsW
CreateIconFromResourceEx
CreateIconFromResource
CharUpperW
CharLowerW

gdi32

CreateCompatibleDC
DeleteDC
GetObjectType
GetObjectW
SelectObject
BitBlt
GetPixel
SetPixel
DeleteObject
SetBkMode
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateSolidBrush
GetStockObject
SetBkColor
SetTextColor
MoveToEx
LineTo
CreateFontIndirectW
CreateRectRgnIndirect
SelectClipRgn
TextOutW
CreatePen
CreateDIBSection
GdiGetBatchLimit
GdiSetBatchLimit
CreateDCW
SetStretchBltMode
StretchBlt
GetDeviceCaps
GetDIBits
SetTextAlign
SetBrushOrgEx
SelectPalette
RealizePalette
SetPixelV
Rectangle
Ellipse
StretchDIBits
SetROP2
ExtFloodFill
RoundRect
GetTextMetricsW
CreateBitmap

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegOpenKeyExW
RegOpenKeyW
RegConnectRegistryW
RegEnumValueW
RegCloseKey
RegQueryValueExW
RegDeleteKeyW
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ImageList_GetIconSize

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
RevokeDragDrop

shell32

ShellExecuteExW

winmm

timeBeginPeriod

ntdll

ZwUnmapViewOfSection

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

wininet

HttpQueryInfoW
InternetOpenW
InternetConnectW
InternetSetOptionW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetReadFile
InternetCloseHandle

Sections

.code
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 591KB - Virtual size: 591KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82593b0fa62ddfd166e2c785c669a896

Headers

File Characteristics

Imports

msvcrt

kernel32

gdiplus

user32

gdi32

comdlg32

advapi32

comctl32

ole32

shell32

winmm

ntdll

setupapi

wininet

Sections

.code Size: 237KB - Virtual size: 237KB

.text Size: 591KB - Virtual size: 591KB

.rdata Size: 135KB - Virtual size: 134KB

.data Size: 1.0MB - Virtual size: 1.0MB

.rsrc Size: 18KB - Virtual size: 18KB

.code
Size: 237KB - Virtual size: 237KB

.text
Size: 591KB - Virtual size: 591KB

.rdata
Size: 135KB - Virtual size: 134KB

.data
Size: 1.0MB - Virtual size: 1.0MB

.rsrc
Size: 18KB - Virtual size: 18KB