e00db0aaecd59b56787a5551349a0f1d246c9f0208708c641a34e0bf1474a697

Sharing

Copy URL Twitter E-mail

General

Target

e00db0aaecd59b56787a5551349a0f1d246c9f0208708c641a34e0bf1474a697
Size

224KB
MD5

a48c594edaa9442d17ca0e0025f61116
SHA1

b015f5b2c5fc590155bab1f970f0a2e3a4d64881
SHA256

e00db0aaecd59b56787a5551349a0f1d246c9f0208708c641a34e0bf1474a697
SHA512

5d2a6f4959a325fa6f45d8b0f21eadae78614189c494e0573d803a269f6ea7ce41840d7a950ab43ce459042b26333c76d5ac472f77cd52715c56361853214cf3
SSDEEP

3072:S4cvhTXJXMPw5UAvAbP2o8p1H5yPYlu5l6pnctSZh6tBYn:aRrvvsPb5GgQncQaBYn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e00db0aaecd59b56787a5551349a0f1d246c9f0208708c641a34e0bf1474a697

Files

e00db0aaecd59b56787a5551349a0f1d246c9f0208708c641a34e0bf1474a697
.exe windows:4 windows x86 arch:x86

699a6758caa43fc2a430a06e77fbbeb5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
fgets
__CxxFrameHandler
_endthreadex
_beginthreadex
_except_handler3
sscanf
sprintf
isdigit
calloc
fprintf
printf
perror
_errno
strerror
fflush
wcstombs
mbstowcs
wcscpy
memcmp
fputc
wcscat
__p__commode
_ftol
rand
srand
fwrite
fopen
fseek
ftell
fread
fclose
malloc
free
exit
_memccpy
_stricmp
strncat
strncmp
atof
strchr
strcat
system
atoi
strcmp
strcpy
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
memset
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
__p__fmode
__set_app_type
_controlfp
strtok
_strdup

msvcp60

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

kernel32

ResetEvent
GetStartupInfoA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
TlsGetValue
SetLastError
TlsFree
TlsAlloc
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcessId
SetThreadPriority
RaiseException
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
CreateEventA
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
InterlockedIncrement
GetThreadPriority
EnterCriticalSection
LeaveCriticalSection
ResumeThread
InterlockedDecrement
TransactNamedPipe
TerminateProcess
MultiByteToWideChar
GetLastError
GetTempPathA
ExitProcess
DeleteFileA
GetSystemDirectoryA
CopyFileA
GetModuleFileNameA
OpenProcess
GetModuleHandleA
FreeConsole
AllocConsole
GetStdHandle
WriteFile
GetTickCount
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
CreateProcessA
ExpandEnvironmentStringsA
GetComputerNameA
GetVersionExA
GlobalMemoryStatus
ReadFile
CloseHandle
WaitForSingleObject
CreateFileA
WaitNamedPipeA
CreateNamedPipeA

user32

ExitWindowsEx
wsprintfA

advapi32

CloseServiceHandle
RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
RegSetValueExA
ChangeServiceConfig2A
RegDeleteValueA
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA

ws2_32

WSAIoctl
gethostname
sendto
htonl
setsockopt
WSASocketA
ntohs
shutdown
WSASetLastError
gethostbyaddr
inet_ntoa
gethostbyname
ioctlsocket
getpeername
getsockname
send
recv
WSACleanup
WSAStartup
inet_addr
WSAGetLastError
select
__WSAFDIsSet
accept
bind
listen
closesocket
socket
htons
getservbyname
connect

netapi32

NetUseDel
NetApiBufferFree
NetShareEnum
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD
NetUseAdd

mpr

WNetAddConnection2A
WNetCancelConnection2W
WNetCancelConnection2A
WNetAddConnection2W

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses

dnsapi

DnsQuery_A

Sections

.text
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.anim23
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

699a6758caa43fc2a430a06e77fbbeb5

Headers

File Characteristics

Imports

msvcrt

msvcp60

kernel32

user32

advapi32

shell32

ws2_32

netapi32

mpr

psapi

dnsapi

Sections

.text Size: 144KB - Virtual size: 140KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 40KB - Virtual size: 41KB

.anim23 Size: 16KB - Virtual size: 16KB

.text
Size: 144KB - Virtual size: 140KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 40KB - Virtual size: 41KB

.anim23
Size: 16KB - Virtual size: 16KB