a9e68d59c7e4166bbd80cea8bb45434c76d325504bea70c77c43912a49463eb4

Sharing

Copy URL Twitter E-mail

General

Target

a9e68d59c7e4166bbd80cea8bb45434c76d325504bea70c77c43912a49463eb4
Size

180KB
MD5

ea4a06f7f224d49297b2a2dfc79a35e9
SHA1

7e0eadd70171d876048da04303f52181bd9c28a1
SHA256

a9e68d59c7e4166bbd80cea8bb45434c76d325504bea70c77c43912a49463eb4
SHA512

abbf4afe7afb120f218995413b70628f0c9159481ec9d3eccd165771fc716d841399904e21c3a3422c78c81f4d307b6f41b9cb54bde11054c8ba207d051c1e26
SSDEEP

3072:idtdThY+NhWqgXJgaHfswQtTUFAiIhkO70Grr+TQTt+SDlWJ:EThBbWqgXJPyrhkO7Xrr+TAUSJg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9e68d59c7e4166bbd80cea8bb45434c76d325504bea70c77c43912a49463eb4

Files

a9e68d59c7e4166bbd80cea8bb45434c76d325504bea70c77c43912a49463eb4
.exe windows:6 windows x86 arch:x86

bd7c128b966a6e15be6b7edf2deadedb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchProtocolHost.pdb

Imports

advapi32

CopySid
GetLengthSid
IsValidSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
InitializeAcl
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
AdjustTokenPrivileges
LookupPrivilegeValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
OpenThreadToken
LookupAccountNameW
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
MakeSelfRelativeSD
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorLength
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
GetSidSubAuthority
RegEnumValueW
RegQueryValueExW
SetSecurityDescriptorSacl
MakeAbsoluteSD
InitializeSid
GetSidLengthRequired
DeleteAce
EqualPrefixSid
LookupAccountSidW
CreateWellKnownSid
DeregisterEventSource
RegisterEventSourceW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

FindResourceW
LoadLibraryExW
GetModuleFileNameW
ResetEvent
SetThreadPriority
CreateThread
LocalFree
GetHandleInformation
OpenEventW
GetCurrentProcessId
SetErrorMode
HeapSetInformation
lstrlenA
GetComputerNameW
SearchPathW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
FindResourceExW
WaitForSingleObjectEx
ReleaseMutex
LoadLibraryW
OutputDebugStringW
CopyFileA
DeleteFileA
FlushViewOfFile
GetLocalTime
CreateFileA
FormatMessageA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
LCMapStringW
LoadResource
CompareFileTime
RemoveDirectoryW
FindFirstFileW
FindNextFileW
FindClose
SetPriorityClass
GetPriorityClass
IsValidCodePage
OpenFileMappingW
OpenSemaphoreW
CreateFileMappingW
ReleaseSemaphore
ExpandEnvironmentStringsW
SetEnvironmentVariableW
CreateFileW
DuplicateHandle
GetFileSize
GetFileTime
UnlockFile
LockFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
WriteFile
ReadFile
DeleteFileW
FormatMessageW
VerifyVersionInfoW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
InterlockedCompareExchange
Sleep
GetEnvironmentVariableW
InterlockedExchange
GetVersionExA
SizeofResource
MultiByteToWideChar
GetTickCount
GlobalAlloc
GlobalFree
MapViewOfFile
UnmapViewOfFile
GlobalLock
GlobalUnlock
LoadLibraryA
GetCurrentThread
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW
CompareStringW
GetSystemDefaultLCID
lstrlenW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
CloseHandle
FreeLibrary
GetProcAddress
CreateEventW
SetEvent
WaitForSingleObject
GetCurrentThreadId
GetModuleHandleW
GetVersionExW
InterlockedDecrement
InterlockedIncrement
SetLastError
GetCurrentProcess
GetProcessTimes
lstrcmpW

msvcrt

_vsnwprintf
strerror
_ultow
_vsnprintf
strncmp
bsearch
isalnum
iswspace
fprintf
_iob
_controlfp
free
_onexit
_lock
__dllonexit
_unlock
realloc
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_errno
__CxxFrameHandler
_set_error_mode
_wcsicmp
_wtoi
_itow
_time64
_CxxThrowException
memcpy
memset
wcschr
_purecall
_wcsnicmp
wcsncmp
malloc
_wtol

user32

CharNextW
GetLastInputInfo
UnregisterClassA
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
LoadStringW

ole32

CoInitializeEx
CoUninitialize
PropVariantClear
CoTaskMemFree
CoUnmarshalInterface
CreateStreamOnHGlobal
CoTaskMemAlloc
CreateBindCtx
CoTaskMemRealloc
CoCreateInstance
CoDisconnectObject
CoInitializeSecurity
StringFromCLSID
CLSIDFromProgID
PropVariantCopy
CLSIDFromString

oleaut32

GetErrorInfo
VarUI4FromStr
CreateErrorInfo
SetErrorInfo
SysStringLen
SysFreeString

tquery

?ciNew@@YGPAXI@Z
?ciNewNoThrow@@YGPAXI@Z
?ciDelete@@YGXPAX@Z

shell32

ord155
SHCreateShellItem
SHParseDisplayName

propsys

PSGetPropertyDescription
PSGetItemPropertyHandlerWithCreateObject

msshooks

LoadMSSearchHooks

shlwapi

SHRegGetValueW

ntdll

VerSetConditionMask
RtlUnwind

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bd7c128b966a6e15be6b7edf2deadedb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

tquery

shell32

propsys

msshooks

shlwapi

ntdll

Sections

.text Size: 159KB - Virtual size: 158KB

.data Size: 10KB - Virtual size: 10KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 159KB - Virtual size: 158KB

.data
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB