2b9035a3161e668c7c225e452ed620b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2b9035a3161e668c7c225e452ed620b0N.exe
Size

191KB
MD5

2b9035a3161e668c7c225e452ed620b0
SHA1

974e74dea1e594c72f9715708d77c13984c0c7dd
SHA256

ae01658c7663249e8b8d4c2a485a0f2a8ced5d52b0b30101fcf74836985ae993
SHA512

5892dbb29161c5474d4a3e2cc47ba185c7bbf4a16ae1bda849f03934463307d5ceed0619f1a88d26da58298a33d092d6161251fe9ad7f138f700da834104409e
SSDEEP

3072:yAKEsYqqjfipJWYpWJZfGXFxUYyaJC6sOMD5Qjj9jRMKSlJ8subptbbG+X:RKE+qjfipJWYpWJZfGXFRJJRsOM9+j5L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b9035a3161e668c7c225e452ed620b0N.exe

Files

2b9035a3161e668c7c225e452ed620b0N.exe
.exe windows:5 windows x86 arch:x86

59b7c12b805e8f464a99915a7933b0f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
SetEvent
CreateEventA
GlobalLock
GlobalUnlock
LoadLibraryA
GetLogicalDrives
GetDiskFreeSpaceExA
CreateFileW
CompareStringW
GetStringTypeW
HeapSize
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
FlushFileBuffers
WriteConsoleW
IsProcessorFeaturePresent
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreatePipe
GetFileAttributesA
LCMapStringW
IsValidCodePage
GetOEMCP
GetFileTime
GetDriveTypeA
SetFileTime
GetTickCount
OpenFile
GetCurrentProcessId
IsDebuggerPresent
GetSystemTime
GetLocalTime
LocalFree
GetVersionExA
GetModuleHandleA
GlobalMemoryStatusEx
GlobalFree
GetProcAddress
GlobalAlloc
GetCurrentProcess
CreateThread
CreateToolhelp32Snapshot
GetModuleFileNameA
Process32Next
TerminateProcess
CreateProcessA
TerminateThread
OpenProcess
WaitForSingleObject
Process32First
SetErrorMode
EndUpdateResourceA
EnumResourceNamesA
LoadLibraryExA
BeginUpdateResourceA
LockResource
GetBinaryTypeA
UpdateResourceA
LoadResource
FreeLibrary
FreeResource
FindResourceA
OpenFileMappingA
CloseHandle
CreateFileMappingA
SetLastError
GetLastError
UnmapViewOfFile
GetACP
GetCPInfo
LoadLibraryW
InterlockedDecrement
GetCurrentThreadId
RaiseException
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
HeapCreate
GetCurrentDirectoryW
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
SetFilePointer
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
ReadFile
MapViewOfFile
SetFileAttributesA
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DuplicateHandle
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
CreateDirectoryA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
HeapFree
HeapAlloc
HeapReAlloc
DeleteFileA
GetModuleHandleW
ExitProcess
DecodePointer
Sleep
GetSystemTimeAsFileTime
MultiByteToWideChar

user32

CloseClipboard
GetWindowThreadProcessId
GetKeyboardLayout
GetForegroundWindow
CallNextHookEx
GetKeyState
UnhookWindowsHookEx
DispatchMessageA
SetWindowsHookExA
TranslateMessage
GetClipboardData
ReleaseDC
GetDC
MessageBoxA
EmptyClipboard
OpenClipboard
GetWindowRect
EnumWindows
GetWindowTextA
GetDesktopWindow
IsWindowVisible
SetClipboardData
GetMessageA

gdi32

SelectObject
CreateCompatibleBitmap
CreateDIBSection
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC

advapi32

CheckTokenMembership
SetSecurityDescriptorDacl
RegEnumKeyA
RegOpenKeyA
LookupAccountSidW
ConvertStringSidToSidA
OpenSCManagerA
StartServiceA
CreateServiceA
ChangeServiceConfig2A
DeleteService
CloseServiceHandle
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
SetKernelObjectSecurity
FreeSid
AllocateAndInitializeSid
GetTokenInformation
ConvertSidToStringSidA
OpenProcessToken
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor

shell32

ShellExecuteA

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantInit

shlwapi

SHDeleteKeyA

wininet

InternetConnectA
InternetReadFile
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
HttpOpenRequestA
InternetGetConnectedState
HttpSendRequestA
InternetOpenA

winmm

mciSendStringA

wsock32

connect
WSAStartup
send
gethostbyname
closesocket
socket
recv
htons

iphlpapi

GetAdaptersInfo

gdiplus

GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipFree
GdipAlloc
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipCloneImage

mpr

WNetEnumResourceA
WNetOpenEnumA
WNetCloseEnum

netapi32

NetUserAdd
NetLocalGroupAddMembers

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59b7c12b805e8f464a99915a7933b0f8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

iphlpapi

gdiplus

mpr

netapi32

Sections

.text Size: 143KB - Virtual size: 142KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 14KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 143KB - Virtual size: 142KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 14KB

.reloc
Size: 11KB - Virtual size: 11KB