d8e96d0267e6095f24cfc07b64ce9eb8b322f3647c33c61cf3730740d1932554

Sharing

Copy URL Twitter E-mail

General

Target

d8e96d0267e6095f24cfc07b64ce9eb8b322f3647c33c61cf3730740d1932554
Size

66KB
MD5

174a8a7a96ff5c3eb631b22a7c79c720
SHA1

2d59db81877f874874e5b145136643345358ad86
SHA256

d8e96d0267e6095f24cfc07b64ce9eb8b322f3647c33c61cf3730740d1932554
SHA512

9f6761265e023fe0c1683adfe5f9f8da63a02e6c1e17c480533261e83ba5144f8a0cca3a65fc584ce2fb3b4abf1e186083fb25ee06fb57cda5ddc3ded3a3a0e2
SSDEEP

768:JdE4p1BR58PqpMeKYPj8IFOzF4hOpxY/CTRcdXartsGuwGg6rH/OY/7IsHQ:SzYP/FM4hgtCXGpHGg6L/RQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8e96d0267e6095f24cfc07b64ce9eb8b322f3647c33c61cf3730740d1932554

Files

d8e96d0267e6095f24cfc07b64ce9eb8b322f3647c33c61cf3730740d1932554
.exe windows:5 windows x86 arch:x86

5b7c6e4ad6237349266a8fee21d7b30d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

resrcmon.pdb

Imports

msvcrt

isdigit
wcscpy
_snprintf
wcscat
mbstowcs
iswspace
wcsrchr
wcsncmp
wcsncat
printf
memmove
wcsncpy
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_wgetenv
swscanf
_snwprintf
wcslen
wcschr
_wtoi
toupper
_except_handler3
strrchr

advapi32

TraceMessage
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
EnableTrace
RegEnumKeyExW
StartTraceW
QueryTraceW
RegQueryValueExW
RegisterEventSourceW
ReportEventW
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW

kernel32

LeaveCriticalSection
ReleaseMutex
GetCurrentThreadId
GetLastError
RaiseException
WaitForSingleObject
EnterCriticalSection
SetLastError
LocalFree
SetEvent
CreateThread
CreateMutexW
LocalAlloc
GetSystemTimeAsFileTime
CloseHandle
Sleep
WaitForMultipleObjects
CreateEventA
SetErrorMode
lstrlenW
lstrcpyW
FormatMessageW
TerminateProcess
lstrcmpiA
InterlockedCompareExchange
InterlockedExchange
SetThreadPriority
IsDebuggerPresent
ExitProcess
lstrcmpW
FreeLibrary
GetProcAddress
DebugBreak
OutputDebugStringW
OutputDebugStringA
LoadLibraryW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetEnvironmentVariableW
InitializeCriticalSection
SetPriorityClass
MapViewOfFile
GetSystemWow64DirectoryW
CreateProcessW
GetCurrentProcessId
DuplicateHandle
OpenProcess
SetUnhandledExceptionFilter
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
UnhandledExceptionFilter
lstrcmpiW
GetLocaleInfoW
FormatMessageA
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetSystemTime
FlushFileBuffers
GetFileAttributesW
CreateDirectoryW
ExpandEnvironmentStringsW
CreateFileW
MoveFileExW
lstrcatW
PostQueuedCompletionStatus
CompareStringW
LocalSize
LocalReAlloc
InterlockedIncrement
GetCurrentThread
CreateEventW
ResetEvent
SetCurrentDirectoryW
GetModuleFileNameW
GetCurrentProcess
VirtualQuery

rpcrt4

RpcServerUseProtseqW
RpcServerRegisterAuthInfoA
RpcServerRegisterIfEx
RpcServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcMgmtWaitServerListen
RpcBindingInqAuthClientA
RpcImpersonateClient
I_RpcMapWin32Status
RpcRevertToSelf
RpcServerInqBindings
RpcStringFreeW
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingVectorFree
NdrServerCall2

ntdll

RtlUnicodeStringToInteger
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
NtQuerySystemInformation
RtlInitUnicodeString

user32

wsprintfW

ole32

CLSIDFromProgID
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CLSIDFromString
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

clusapi

ClusterRegCreateKey
ClusterRegQueryValue
GetClusterKey
ClusterRegOpenKey
OpenCluster
ClusterRegCloseKey

resutils

ResUtilSetPrivatePropertyList
ResUtilEnumProperties
ResUtilGetProperties
ResUtilEnumPrivateProperties
ResUtilGetPrivateProperties
ResUtilVerifyPrivatePropertyList
ResUtilVerifyPropertyTable
ResUtilSetPropertyTable
ResUtilFreeParameterBlock
ResUtilGetDwordValue
ResUtilGetPropertyFormats

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b7c6e4ad6237349266a8fee21d7b30d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

rpcrt4

ntdll

user32

ole32

oleaut32

clusapi

resutils

Sections

.text Size: 62KB - Virtual size: 61KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 65KB

.text
Size: 62KB - Virtual size: 61KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 65KB