e9e3aedf65ec844d3ddc75cbb35123430cdcb79c8ef0c07eca6cef18056e27f3

Sharing

Copy URL Twitter E-mail

General

Target

e9e3aedf65ec844d3ddc75cbb35123430cdcb79c8ef0c07eca6cef18056e27f3
Size

704KB
MD5

00acf26543da1efb62cbb04e652cf420
SHA1

5e0da89e09d9c0afc751a92359f4d77db5af9f73
SHA256

e9e3aedf65ec844d3ddc75cbb35123430cdcb79c8ef0c07eca6cef18056e27f3
SHA512

f1a15b61e2c8787cf828ecf1b9a2b1fc223a0713a3df6c83131d67ff8dd65933a83214ba2243505e710095d7ea9df746e17c15aa2e89b3c1470e1960e7dfca3d
SSDEEP

12288:cK7h/O2orCBypiJ1YQGSL66WocQl0ckLn8ulSsUSCYFanf81Waf0nAK:c2h/Fo+spi3YQGSL66zk71MNSDanf81k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9e3aedf65ec844d3ddc75cbb35123430cdcb79c8ef0c07eca6cef18056e27f3

Files

e9e3aedf65ec844d3ddc75cbb35123430cdcb79c8ef0c07eca6cef18056e27f3
.exe windows:4 windows x86 arch:x86

39456f7e520be323d01bac34010a9ed4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetCloseEnum
WNetOpenEnumA
WNetEnumResourceA

kernel32

LocalFree
GetExitCodeThread
WaitForMultipleObjects
SetNamedPipeHandleState
GetCurrentThread
GetComputerNameA
GetProcessHeap
HeapAlloc
HeapFree
EnumResourceLanguagesA
lstrcmpiA
LoadLibraryExA
FlushFileBuffers
DisconnectNamedPipe
LeaveCriticalSection
ReleaseMutex
OpenMutexA
FindResourceA
CompareStringW
CompareStringA
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetTimeZoneInformation
GetACP
HeapReAlloc
HeapSize
RaiseException
ExitProcess
GetStartupInfoA
GetDriveTypeA
RtlUnwind
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
EnterCriticalSection
WaitForSingleObject
OpenFileMappingA
CreateMutexA
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
GetModuleFileNameA
ExpandEnvironmentStringsA
GetShortPathNameA
MoveFileExA
WritePrivateProfileSectionA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetProfileIntA
SetLastError
EnumSystemLocalesA
GetSystemInfo
GetVersionExA
IsBadReadPtr
IsBadStringPtrA
GetCurrentProcessId
GetCurrentProcess
DuplicateHandle
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetEnvironmentVariableA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
WriteProcessMemory
ReadProcessMemory
GlobalReAlloc
GlobalSize
GlobalFlags
GetWindowsDirectoryA
GetLocalTime
EnumResourceNamesA
MoveFileA
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
TlsAlloc
LocalAlloc
SetErrorMode
GetVersion
lstrcatA
LoadResource
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpynA
InterlockedDecrement
InterlockedIncrement
lstrlenA
LockResource
GetCurrentDirectoryA
SetCurrentDirectoryA
RemoveDirectoryA
GetTempPathA
GetTempFileNameA
DeleteFileA
GetFileAttributesA
CreateProcessA
SetThreadPriority
ResumeThread
FindFirstFileA
FindNextFileA
FindClose
CreateDirectoryA
GetSystemDirectoryA
SetEndOfFile
ReadFile
lstrcpyA
GetFileSize
SetFilePointer
CreateFileA
GetModuleHandleA
FormatMessageA
GlobalGetAtomNameA
GetCurrentThreadId
TransactNamedPipe
WriteFile
GetTickCount
WaitNamedPipeA
lstrcmpA
MulDiv
GetLocaleInfoA
OpenProcess
TerminateProcess
CloseHandle
LoadLibraryA
GetProcAddress
FreeLibrary
WriteProfileStringA
GetProfileStringA
WideCharToMultiByte
MultiByteToWideChar
IsDBCSLeadByteEx
CopyFileA
SetFileAttributesA
GetLastError
Sleep
GetCommandLineA
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
SetEnvironmentVariableA

user32

GetKeyState
GetWindow
SetWindowPos
GetSystemMetrics
GetClassNameA
SetCursor
ShowCursor
LoadCursorA
GetWindowLongA
ReleaseDC
GetDC
GetClientRect
GetWindowTextA
SendMessageA
GetWindowRect
EnableWindow
GetDlgItem
IntersectRect
GetDlgCtrlID
GetDlgItemTextA
GetDialogBaseUnits
SetWindowTextA
wvsprintfA
DrawTextA
GetWindowTextLengthA
GetParent
PtInRect
IsWindowEnabled
UpdateWindow
InvalidateRect
SetWindowLongA
SetDlgItemTextA
SetFocus
IsZoomed
ScreenToClient
PeekMessageA
PostQuitMessage
IsDialogMessageA
TranslateMessage
DispatchMessageA
DeferWindowPos
GetClassLongA
ClientToScreen
ExitWindowsEx
SetRect
GetSysColorBrush
FillRect
RemovePropA
CallWindowProcA
GetPropA
SetPropA
MsgWaitForMultipleObjects
BeginPaint
EndPaint
DefWindowProcA
IsIconic
GetClassInfoA
RegisterClassA
LoadImageA
SystemParametersInfoA
KillTimer
DestroyWindow
UnregisterClassA
GetSystemMenu
GetMenuItemCount
GetMenuItemID
DeleteMenu
OffsetRect
GetWindowThreadProcessId
GrayStringA
TabbedTextOutA
GetSysColor
CopyRect
DrawFocusRect
EndDialog
DialogBoxParamA
wsprintfA
SendMessageTimeoutA
GetDesktopWindow
LoadStringA
OpenClipboard
EmptyClipboard
SetClipboardData
LoadBitmapA
GetCursorPos
IsWindowVisible
ValidateRect
ShowWindow
GetActiveWindow
GetMessageA
GetWindowPlacement
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
GetSubMenu
GetMenu
GetCapture
GetTopWindow
AdjustWindowRectEx
GetFocus
MapWindowPoints
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
DestroyMenu
CloseClipboard
GetAsyncKeyState
IsDlgButtonChecked
LoadIconA
DestroyIcon
WinHelpA
IsWindow
EnumWindows
CharLowerA
CallNextHookEx
CreateWindowExA
MessageBeep
SetWindowsHookExA
MessageBoxA
UnhookWindowsHookEx
GetLastActivePopup
PostMessageA
FindWindowA
SetTimer
CharUpperA

gdi32

SetMapMode
GetRgnBox
GetFontLanguageInfo
SetBkColor
StretchBlt
BitBlt
CreateFontA
TranslateCharsetInfo
GetCharacterPlacementW
GetCharacterPlacementA
GetObjectType
GetGlyphOutlineW
GetCurrentObject
SetPixel
CreateCompatibleDC
CreateFontIndirectA
DeleteObject
ResetDCA
EnumFontFamiliesExA
CreateCompatibleBitmap
PatBlt
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetOutlineTextMetricsA
GetCharWidthW
GetCharWidthA
GetStockObject
GetObjectA
CreateDCA
ExtEscape
DeleteDC
GetTextExtentPointA
GetTextMetricsA
SelectObject
GetTextExtentPoint32A
GetDeviceCaps
SaveDC
RestoreDC
SetTextColor
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
GetClipBox

winspool.drv

DeletePrinterConnectionA
GetPrinterDriverDirectoryA
AddPrinterW
AddPrinterA
DeviceCapabilitiesA
AddPrinterConnectionA
AddMonitorA
AddPrinterDriverA
SetPrinterA
SetPrinterW
DeletePrinter
GetPrinterA
GetPrinterW
OpenPrinterW
OpenPrinterA
EnumPrinterDriversA
EnumPrintersW
EnumPrintersA
EnumPortsA
GetJobA
ClosePrinter
DeletePrinterDriverA
DeleteMonitorA
DocumentPropertiesA
GetPrinterDriverA

advapi32

SetSecurityDescriptorDacl
RegCloseKey
RegQueryValueExA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenThreadToken
OpenProcessToken
GetUserNameA
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteKeyA
GetSidLengthRequired
GetSidIdentifierAuthority
InitializeSid
LookupAccountSidW
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityDescriptorOwner
LookupAccountNameA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
FreeSid
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
EnumDependentServicesA
DeleteService
CreateServiceA
CloseServiceHandle
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegSetKeySecurity
RegConnectRegistryA
RegFlushKey
RegUnLoadKeyA
RegLoadKeyA
LookupAccountSidA
RegEnumKeyA
RegGetKeySecurity
RegCreateKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegOpenKeyA
InitializeSecurityDescriptor

shell32

SHGetFileInfoA
SHChangeNotify
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA
SHGetSpecialFolderLocation
ExtractIconExA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

comctl32

ImageList_ReplaceIcon
ord17

Sections

.text
Size: 472KB - Virtual size: 468KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 64KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

39456f7e520be323d01bac34010a9ed4

Headers

File Characteristics

Imports

mpr

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

version

comctl32

Sections

.text Size: 472KB - Virtual size: 468KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 64KB - Virtual size: 90KB

.rsrc Size: 124KB - Virtual size: 124KB

.text
Size: 472KB - Virtual size: 468KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 64KB - Virtual size: 90KB

.rsrc
Size: 124KB - Virtual size: 124KB