ca5cbd16e5d10dbcc293c0d168ccc5b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ca5cbd16e5d10dbcc293c0d168ccc5b0N.exe
Size

5.9MB
MD5

ca5cbd16e5d10dbcc293c0d168ccc5b0
SHA1

01218b8560a3d20b4b1af96cb4ea4c396ae70e4b
SHA256

a5199ff6bfed97989e37e135e3ea8d9344527c7e63f5b3c2c1e9afbca5ce24a3
SHA512

726601134298176e99b917b951d5997d4c0d75be294c36b41ef73323b00444e619f5eb396757f46471ba60e276b0b48e1c63e09786280bd6960495889bf98aa5
SSDEEP

98304:Yiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii+:Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca5cbd16e5d10dbcc293c0d168ccc5b0N.exe

Files

ca5cbd16e5d10dbcc293c0d168ccc5b0N.exe
.exe windows:5 windows x86 arch:x86

77dac6fdf0cb9a30acd5a2534bf4ba24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
lstrcpyA
TlsFree
lstrcmpiA
GetCurrentProcessId
LCMapStringW
ExitProcess
CreateEventA
lstrlenW
GetFileSize
GetSystemTimeAsFileTime
CreateThread
InterlockedIncrement
FreeEnvironmentStringsA
lstrcmpiW
CreateFileMappingA
FileTimeToLocalFileTime
GetStringTypeA
CreateFileMappingW
GetSystemDirectoryA
CreateFileW
GetModuleFileNameW
GetCPInfo
CreateEventW
DisableThreadLibraryCalls
CompareStringA
GetStdHandle
VirtualAllocEx
GetLocalTime

atmlib

ATMAddFont

rpcrt4

IUnknown_Release_Proxy
NdrCStdStubBuffer2_Release
RpcServerRegisterAuthInfoW
NdrOleFree
RpcServerRegisterIfEx
NdrDllUnregisterProxy
RpcServerUnregisterIf
IUnknown_QueryInterface_Proxy
CStdStubBuffer_QueryInterface
NdrStubForwardingFunction
CStdStubBuffer_Invoke
RpcBindingToStringBindingW
NdrClientCall2
RpcBindingSetAuthInfoW
RpcServerUseProtseqEpW
RpcBindingSetAuthInfoExW
RpcStringFreeA
NdrStubCall2
CStdStubBuffer_Disconnect
RpcBindingFromStringBindingW
CStdStubBuffer_CountRefs
NdrDllCanUnloadNow
RpcImpersonateClient
UuidToStringW
RpcRevertToSelf
UuidFromStringW
RpcBindingFree

ole32

OleRegEnumVerbs
CoInitializeEx
OleLoadFromStream
GetRunningObjectTable
CoGetObjectContext
CoInitialize
StgCreateDocfileOnILockBytes
CoUninitialize
CLSIDFromProgID
CreateStreamOnHGlobal
OleInitialize
CoCreateGuid
OleUninitialize
CoMarshalInterThreadInterfaceInStream
GetHGlobalFromStream
CoUnmarshalInterface
CoGetInterfaceAndReleaseStream
StgIsStorageFile
PropVariantCopy
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoRegisterClassObject
OleRun
StringFromIID
CreateILockBytesOnHGlobal
CLSIDFromString
MkParseDisplayName
CreateDataAdviseHolder
CreateOleAdviseHolder

advapi32

DuplicateTokenEx
AddAccessAllowedAce
RegCloseKey
RegisterTraceGuidsW
InitializeAcl
CryptAcquireContextW
MakeSelfRelativeSD
RegSetValueExW
QueryServiceConfigW
CryptCreateHash
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DeregisterEventSource
GetTraceEnableLevel
ChangeServiceConfigW
OpenServiceA
GetSecurityDescriptorLength
RegDeleteKeyA
CloseServiceHandle
OpenSCManagerA
AddAce
GetTraceEnableFlags
EqualSid

shell32

SHFileOperationW
SHChangeNotify
SHGetMalloc
SHGetSpecialFolderPathW
SHGetDesktopFolder

user32

GetSystemMenu
EndPaint
LoadCursorA
GetDC
DialogBoxParamA
CheckDlgButton
PeekMessageA
GetClassNameW
SetDlgItemTextW
GetWindowRect
SetFocus
UnhookWindowsHookEx
MoveWindow
ShowWindow
BeginPaint
UpdateWindow
GetSysColorBrush
DestroyWindow
SetWindowTextA
SetWindowLongW
CreateDialogParamW
GetWindowLongW
WinHelpW
FindWindowW
CopyRect
RegisterClassA
EnableMenuItem
IsRectEmpty
DialogBoxParamW
ClientToScreen
DestroyIcon
MsgWaitForMultipleObjects
GetDesktopWindow
LoadIconA
KillTimer
MessageBoxA
IsWindow
RegisterWindowMessageA
DispatchMessageW

oleaut32

SysFreeString
GetErrorInfo
SafeArrayPtrOfIndex
SafeArrayGetUBound
VariantInit
SysStringByteLen
SysAllocStringByteLen
LoadTypeLib
CreateErrorInfo
SysAllocStringLen
SafeArrayGetElement
VariantCopy

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 24KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77dac6fdf0cb9a30acd5a2534bf4ba24

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

atmlib

rpcrt4

ole32

advapi32

shell32

user32

oleaut32

Sections

.text Size: 57KB - Virtual size: 57KB

.orpc Size: 7KB - Virtual size: 10KB

DATA Size: 11KB - Virtual size: 20KB

INIT Size: 24KB - Virtual size: 48KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 57KB - Virtual size: 57KB

.orpc
Size: 7KB - Virtual size: 10KB

DATA
Size: 11KB - Virtual size: 20KB

INIT
Size: 24KB - Virtual size: 48KB

.reloc
Size: 1KB - Virtual size: 1KB