580a890a32ddd2af4586ec45220af14bc48bc3bf1b4cb4d6c991906075b164fd

Sharing

Copy URL Twitter E-mail

General

Target

580a890a32ddd2af4586ec45220af14bc48bc3bf1b4cb4d6c991906075b164fd
Size

207KB
MD5

9e7e2354e1fc64702308a8deec8e31fd
SHA1

da1704c1c6bce96c3ae8a7bb88bae2264c4b08e3
SHA256

580a890a32ddd2af4586ec45220af14bc48bc3bf1b4cb4d6c991906075b164fd
SHA512

89a3299a4fbde96e905bcadb3e456e6acb867b6ec5572393671eee671bbcaf6521214126eccded0d5bb63c8d9d6a7e4b2761623c1e67e98364e226e746ec9a0c
SSDEEP

6144:ZBUvS5llxmvwwEIfE9tNfaPnFxm5kdA0IWcaBjmpLrXt2:Av4lrmvzEIM9LiPLm5N0zthmd2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
580a890a32ddd2af4586ec45220af14bc48bc3bf1b4cb4d6c991906075b164fd

Files

580a890a32ddd2af4586ec45220af14bc48bc3bf1b4cb4d6c991906075b164fd
.exe windows:5 windows x86 arch:x86

ace3e6d4772d5f1941878a6d1db6c278

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

osk.pdb

Imports

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_controlfp
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
__setusermatherr
_exit
_c_exit
mbstowcs
wcscpy
_wcsicmp
free
wcstombs
malloc

advapi32

CheckTokenMembership
RegOpenKeyExA
RegQueryValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
AllocateAndInitializeSid
FreeSid
OpenThreadToken
OpenProcessToken
GetTokenInformation

kernel32

LocalFree
LocalAlloc
GetCurrentProcess
GetLastError
GetCurrentThread
GetProcAddress
CloseHandle
lstrlenW
lstrcmpiW
WaitForMultipleObjects
CreateThread
GetCurrentThreadId
OpenEventW
CreateEventW
SetEvent
ReleaseMutex
CreateMutexW
SetLastError
GetCommandLineW
lstrcmpW
ExitProcess
GetVersionExW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
lstrcpyW
GetNumberFormatW
LoadLibraryA

gdi32

CreateFontIndirectW
CreatePenIndirect
SelectObject
SetTextColor
BitBlt
SetBkColor
CreateSolidBrush
DeleteDC
CreateBitmap
TextOutW
GetTextMetricsW
SetBkMode
RealizePalette
SelectPalette
GetObjectW
StretchBlt
CreateCompatibleDC
CreateRoundRectRgn
SetMapMode
DeleteObject
Polyline

user32

FindWindowW
SetTimer
MapVirtualKeyW
GetAsyncKeyState
GetMenu
ActivateKeyboardLayout
SendMessageW
GetDlgItem
EndDialog
LoadStringW
EnableWindow
MessageBoxW
DialogBoxParamW
IsWindow
GetKeyboardLayout
GetWindowThreadProcessId
wsprintfW
CheckDlgButton
GetClientRect
DestroyWindow
InvalidateRect
WinHelpW
GetKeyboardType
SetClassLongW
RegisterClassW
GetClassInfoW
LoadCursorW
CreateWindowExW
GetSystemMetrics
SetWindowPos
SetWindowLongW
GetKeyState
DrawIconEx
LoadImageW
SetWindowRgn
ToUnicodeEx
LoadIconW
GetWindowLongW
GetSysColor
ReleaseDC
GetDC
MapVirtualKeyExW
CloseDesktop
GetUserObjectInformationW
OpenDesktopW
OpenInputDesktop
PostMessageW
SetThreadDesktop
GetThreadDesktop
EndPaint
BeginPaint
DefWindowProcW
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation
CloseWindowStation
MoveWindow
GetDesktopWindow
GetWindowRect
AllowSetForegroundWindow
SetForegroundWindow
GetForegroundWindow
ShowWindow
IsIconic
DispatchMessageW
TranslateMessage
GetMessageW
UpdateWindow
RegisterWindowMessageW
KillTimer
EnableMenuItem
CheckMenuRadioItem
CheckMenuItem
ReleaseCapture
SetCapture
SetCursor
ChildWindowFromPointEx
ScreenToClient
GetCursorPos
PostQuitMessage
SendInput

msswch

ord8
ord13
ord12
ord11
ord10
ord9
ord1
ord14

comdlg32

ChooseFontW

winmm

PlaySoundW

shell32

ord258
ShellExecuteW

comctl32

ord17

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ace3e6d4772d5f1941878a6d1db6c278

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

gdi32

user32

msswch

comdlg32

winmm

shell32

comctl32

ole32

Sections

.text Size: 107KB - Virtual size: 107KB

.data Size: 11KB - Virtual size: 12KB

.rsrc Size: 87KB - Virtual size: 183KB

.text
Size: 107KB - Virtual size: 107KB

.data
Size: 11KB - Virtual size: 12KB

.rsrc
Size: 87KB - Virtual size: 183KB