e22d91d41685fb7be98d4c3ba826da67a55b4a59e023ab38a159bcc2ab14c025

Sharing

Copy URL Twitter E-mail

General

Target

e22d91d41685fb7be98d4c3ba826da67a55b4a59e023ab38a159bcc2ab14c025
Size

58KB
MD5

40e309933d3f7a51ad54e98bc77ac018
SHA1

315978aaa7f99e6f88df6b75c7a964f220b7c9c5
SHA256

e22d91d41685fb7be98d4c3ba826da67a55b4a59e023ab38a159bcc2ab14c025
SHA512

dcfbbe2b9ece2e4d30f9327e6d716a3023fccfe1a8fcd669f034c0bff8e77f1c9144fa7d6e402b8163e98cd939a5151d6f8beed6800e65d1f8c04f9112700ba0
SSDEEP

1536:jUHVW10ycXyBXre4uL3hRiQpH98ALJsOHFE:jU1W10tXy1rnuL3h0QpHtLJsOHFE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e22d91d41685fb7be98d4c3ba826da67a55b4a59e023ab38a159bcc2ab14c025

Files

e22d91d41685fb7be98d4c3ba826da67a55b4a59e023ab38a159bcc2ab14c025
.exe windows:5 windows x86 arch:x86

971ac25346fe06d28dae9519b227c5ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

cmstp.pdb

Imports

msvcrt

_except_handler3
__set_app_type
_c_exit
_vsnprintf
_controlfp
__p__fmode
_mbscmp
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit

advapi32

RegCreateKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
LookupPrivilegeValueA
AdjustTokenPrivileges
AllocateAndInitializeSid
FreeSid
OpenProcessToken
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegCloseKey
RegEnumValueA

kernel32

SetUnhandledExceptionFilter
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
GetVersionExA
GetSystemInfo
CreateDirectoryA
SetCurrentDirectoryA
InterlockedDecrement
InterlockedIncrement
GetStartupInfoA
SetFileAttributesA
LoadLibraryExA
FreeLibrary
GetProcAddress
GetPrivateProfileStringA
Sleep
GetSystemDirectoryA
WritePrivateProfileSectionA
GetShortPathNameA
CloseHandle
WriteFile
lstrlenA
CreateFileA
LockResource
LoadResource
FindResourceA
lstrcatA
GetCurrentDirectoryA
GetCommandLineA
GetModuleHandleA
GetLastError
GetWindowsDirectoryA
LoadLibraryA
lstrcpyA
lstrcpynA
lstrcmpiA
GetPrivateProfileSectionA
lstrcmpA
CompareStringA
GetCurrentProcess
FindNextFileA
FindFirstFileA
UnhandledExceptionFilter
WritePrivateProfileStringA
GetPrivateProfileIntA
LocalFree
ExpandEnvironmentStringsA
WriteProfileStringA
CopyFileA
ReleaseMutex
WaitForSingleObject
CreateMutexA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess

user32

ExitWindowsEx
SetFocus
GetDlgItem
CharNextA
CheckDlgButton
IsDlgButtonChecked
EndDialog
DialogBoxParamA
GetDlgItemTextA
MessageBoxExA
LoadStringA
MessageBoxA
wsprintfA
SetWindowTextA
CharPrevA

advpack

LaunchINFSectionEx
RunSetupCommand

ole32

CoUninitialize
CoInitialize

shell32

ShellExecuteExA
SHGetSpecialFolderLocation
SHGetMalloc
SHChangeNotify
SHGetDesktopFolder
SHFileOperationA
SHGetPathFromIDListA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

971ac25346fe06d28dae9519b227c5ac

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

advpack

ole32

shell32

version

Sections

.text Size: 48KB - Virtual size: 48KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 328KB

.text
Size: 48KB - Virtual size: 48KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 328KB