8de3ea6bd7ea4c850343ee030c7a3ffd35b100b76bfdca92dedb248fad59ebb2

Sharing

Copy URL Twitter E-mail

General

Target

8de3ea6bd7ea4c850343ee030c7a3ffd35b100b76bfdca92dedb248fad59ebb2
Size

292KB
MD5

743ab323c5e92748d0753f1ccca2eca4
SHA1

cb0bd544ecfd9e2fbf41c71eea3beff0f91c918e
SHA256

8de3ea6bd7ea4c850343ee030c7a3ffd35b100b76bfdca92dedb248fad59ebb2
SHA512

46950644f8382b0771cd3c8be1560ca1562121388e11e41e8f7dabaa97aebef1d09dcc41d4e41f60ab61d3e6c4d75a679647f0d03dd280576adaacb4af67db4c
SSDEEP

6144:wBCb5luGsOLWyGhsVODNo8IlQXmhG45g7gCc7K/m5V:WC1w1hsVyNNIl4T6ke

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8de3ea6bd7ea4c850343ee030c7a3ffd35b100b76bfdca92dedb248fad59ebb2

Files

8de3ea6bd7ea4c850343ee030c7a3ffd35b100b76bfdca92dedb248fad59ebb2
.exe windows:6 windows x86 arch:x86

b30081fefb0f0d119756211e2f0695f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

conhost.pdb

Imports

gdi32

DeleteDC
GetDIBits
BitBlt
GetObjectW
SelectObject
CreateCompatibleDC
CreateDIBitmap
PatBlt
InvertRgn
CombineRgn
CreateRectRgn
StretchDIBits
SelectPalette
CreateCompatibleBitmap
GdiFullscreenControl
GdiFlush
PolyPatBlt
GetStockObject
SetBkColor
SetTextColor
SetDCBrushColor
GetNearestColor
DeleteObject
GetTextExtentPoint32W
GetTextMetricsW
EnumFontFamiliesExW
CreateDCW
GetTextFaceW
SetFontEnumeration
GetDeviceCaps
GetRegionData
GetRgnBox
PolyTextOutW
GetCurrentObject
SetBkMode
RealizePalette
SetSystemPaletteUse
GetStringBitmapW
CreateSolidBrush
TranslateCharsetInfo
GetCharWidth32W
CreateBitmap
SetBitmapBits
GetBitmapBits
StretchBlt
CreateFontIndirectW
SetDIBitsToDevice

user32

SetProcessDPIAware
GetForegroundWindow
WindowFromPoint
SetCursor
SendMessageTimeoutW
TrackPopupMenuEx
UnpackDDElParam
CreateIconFromResourceEx
ReuseDDElParam
CreateWindowExW
GetDC
GetSystemMenu
SetActiveWindow
LoadCursorW
KillTimer
ReleaseDC
DestroyWindow
GetKeyboardLayout
SetTimer
ScrollDC
SetScrollInfo
GetWindowRect
MapWindowPoints
MonitorFromRect
GetClientRect
GetMonitorInfoW
ClientToScreen
AdjustWindowRectEx
GetCaretBlinkTime
GetWindowTextW
SetWindowTextW
NotifyWinEvent
MapVirtualKeyW
VkKeyScanW
CloseClipboard
InvalidateRect
GetClipboardData
OpenClipboard
ReleaseCapture
RegisterClassExW
LoadIconW
LoadImageW
EnumDisplaySettingsW
BeginPaint
DrawIcon
EndPaint
DefWindowProcW
SetWindowPos
EnableMenuItem
LoadMenuW
AppendMenuW
SetMenuItemInfoW
ShowWindow
MessageBoxW
GetKeyboardState
ToUnicodeEx
GetMessageW
DispatchMessageW
UnhookWindowsHookEx
RegisterWindowMessageW
SetWindowsHookExW
SetCapture
SetClipboardData
EmptyClipboard
GetKeyState
PrivateExtractIconExW
EnterReaderModeHelper
TranslateMessageEx
ConsoleControl
GetWindowLongW
GetWindowPlacement
SetWindowPlacement
SystemParametersInfoW
ActivateKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
CopyIcon
DestroyIcon
DialogBoxParamW
EndDialog
GetDlgItemTextW
IsDlgButtonChecked
SendNotifyMessageW
SetWindowLongW
SendDlgItemMessageW
CheckRadioButton
PtInRect
ScreenToClient
GetSystemMetrics
SendMessageW
PostMessageW
LoadStringW
GetCursorPos
IsIconic

msvcrt

malloc
free
__set_app_type
_controlfp
_except_handler4_common
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
memcpy
_local_unwind4
_vsnwprintf
wcschr
wcsncmp
wcsrchr
memset
atoi
_itoa
memmove
?terminate@@YAXXZ

ntdll

RtlPrefixUnicodeString
RtlIntegerToUnicodeString
RtlUnicodeToMultiByteSize
RtlInitializeCriticalSectionAndSpinCount
RtlConsoleMultiByteToUnicodeN
RtlDosSearchPath_U
ShipAssert
RtlExitUserProcess
NtReplyWaitReceivePort
NtCreatePort
RtlOpenCurrentUser
NtEnumerateValueKey
NtQueryValueKey
RtlCreateTagHeap
NtOpenKey
NtAcceptConnectPort
NtWaitForMultipleObjects
NtSetInformationProcess
RtlReAllocateHeap
RtlInitCodePageTable
RtlUnicodeToMultiByteN
RtlMultiByteToUnicodeN
RtlCustomCPToUnicodeN
RtlOemToUnicodeN
RtlUnicodeToOemN
RtlExitUserThread
RtlInitUnicodeString
RtlUnicodeStringToInteger
NtSetEvent
NtCreateEvent
NtDuplicateObject
NtClearEvent
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtOpenProcess
NtQueryInformationProcess
NtVdmControl
NtReleaseMutant
NtWaitForSingleObject
NtCreateMutant
NtUnmapViewOfSection
NtReadVirtualMemory
RtlEnterCriticalSection
RtlLeaveCriticalSection
NtReplyPort
RtlCompareUnicodeString
RtlSizeHeap
DbgPrintEx
RtlAllocateHeap
NtCreateSection
RtlFreeHeap
NtMapViewOfSection
NtClose
RtlGetCriticalSectionRecursionCount

api-ms-win-core-localregistry-l1-1-0

RegGetValueW

kernel32

CreateFileA
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
GetStringTypeW
GetSystemDirectoryA
GetModuleHandleW
GetACP
CreateThread
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
lstrlenA
LockResource
InterlockedIncrement
InterlockedDecrement
GetVersionExW
VirtualProtect
LoadResource
VirtualAlloc
GetSystemInfo
VirtualQuery
LocalAlloc
LocalFree
LocalReAlloc
FindResourceExW
IsValidCodePage
GetCurrentProcessId
GetCurrentThreadId
GetLastError
CreateActCtxW
GetModuleFileNameW
SetEnvironmentVariableW
GetEnvironmentVariableW
CloseHandle
SetFilePointer
ReadFile
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
ExpandEnvironmentStringsW
GetPrivateProfileStringW
CreateFileW
GetCommandLineW
SetProcessShutdownParameters
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
WideCharToMultiByte
GetCPInfo
lstrlenW
Beep
GetCurrentThread
GetOEMCP
GlobalAlloc

imm32

ImmGetCompositionStringW
ImmGetGuideLineW
ImmGetContext
ImmGetOpenStatus
ImmGetConversionStatus
ImmReleaseContext
ImmAssociateContextEx
ImmAssociateContext
ImmTranslateMessage
ImmNotifyIME
ImmGetProperty
ImmGetCandidateListW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
SysAllocStringLen
SysStringLen
VariantInit
SysAllocString
SysReAllocString
VariantClear

Sections

.text
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

FE_TEXT
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b30081fefb0f0d119756211e2f0695f4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

kernel32

imm32

ole32

oleaut32

Sections

.text Size: 195KB - Virtual size: 195KB

FE_TEXT Size: 21KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 34KB - Virtual size: 33KB

.reloc Size: 36KB - Virtual size: 37KB

.text
Size: 195KB - Virtual size: 195KB

FE_TEXT
Size: 21KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 36KB - Virtual size: 37KB