a146ff956a4ac9b92c0009371765ed92dd81b61f9b6f15c28071a6706e413a49

Sharing

Copy URL Twitter E-mail

General

Target

a146ff956a4ac9b92c0009371765ed92dd81b61f9b6f15c28071a6706e413a49
Size

1.5MB
MD5

3e4f03f0f6ed2bfc4e13af10ab8e1278
SHA1

537da8a13b2dacc312198379346ae4982de7e9bc
SHA256

a146ff956a4ac9b92c0009371765ed92dd81b61f9b6f15c28071a6706e413a49
SHA512

a1bd39295a28905d624c97384b275aba5bbab887f502b46a368d358969e75fe34af0195d3a2641c3e2b67b4547bf99f877cf1d9b2cc0099f5b769341474c24dd
SSDEEP

12288:Lfen0rfgQKHhETvelUi2fHcN/sVvlAKIkDUoPE2LwXYb6kjeeQzqk1k/QkSpSh0P:2yY2fHcNmlJEoPE2Ltb6kjeeQzjXL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a146ff956a4ac9b92c0009371765ed92dd81b61f9b6f15c28071a6706e413a49

Files

a146ff956a4ac9b92c0009371765ed92dd81b61f9b6f15c28071a6706e413a49
.exe windows:5 windows x86 arch:x86

c06f076cbdae138141d0e43af151f71c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\BOOK\UTIL\STI\STI.pdb

Imports

kernel32

SetEnvironmentVariableA
CompareStringW
SetCurrentDirectoryA
GetCurrentDirectoryA
GetComputerNameA
Sleep
CompareStringA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
GetPrivateProfileStringA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualQuery
GetModuleFileNameW
GetProcessHeap
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
InterlockedExchange
SetConsoleCtrlHandler
GetModuleFileNameA
GetStdHandle
GetCurrentThread
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapDestroy
HeapCreate
HeapAlloc
HeapSize
RtlUnwind
CreateDirectoryA
FileTimeToLocalFileTime
GetStartupInfoA
GetCommandLineA
lstrlenA
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
RaiseException
CreateThread
ResumeThread
ExitThread
ExitProcess
GetModuleHandleW
EnumSystemLocalesA
LocalAlloc
GetLastError
lstrcpyA
DeleteFileA
CreateFileA
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetFileTime
GetFileTime
FindClose
FindNextFileA
FindFirstFileA
WritePrivateProfileStringA
GetFullPathNameA
GetDriveTypeA
GetLogicalDriveStringsA
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForSingleObject
CreateProcessA
MultiByteToWideChar
Beep
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
GetFileType
DuplicateHandle
GetCurrentProcess
DosDateTimeToFileTime
LocalFileTimeToFileTime
HeapFree
SetEndOfFile

user32

GetWindowRect
ShowWindow
PostMessageA
ReleaseDC
MessageBeep
SetCursorPos
ClientToScreen
GetKeyState
UpdateWindow
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
GetWindowLongA
IsIconic
GetSystemMetrics
SetWindowTextA
EndPaint
BeginPaint
IsWindowVisible
GetLastActivePopup
SwitchToThisWindow
SetForegroundWindow
SetTimer
SetScrollPos
SetScrollRange
KillTimer
UnregisterHotKey
RegisterHotKey
DefWindowProcA
ReleaseCapture
SetCapture
SetWindowPos
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
CreateCaret
SetCaretPos
ShowCaret
HideCaret
DestroyCaret
MessageBoxA
IsWindow
MapWindowPoints
PtInRect
WindowFromPoint
SetWindowRgn
EnableScrollBar
SetClassLongA
DestroyCursor
SetCursor
LoadCursorFromFileA
SendMessageA
GetDC
GetClientRect
InvalidateRect
GetCursorPos
ScreenToClient
SetScrollInfo
MoveWindow
CloseWindow
OpenIcon
GetActiveWindow
GetClipCursor
GetCapture
ClipCursor
SetActiveWindow
RedrawWindow
PostQuitMessage
DestroyWindow
GetDesktopWindow
InvertRect
FrameRect
DispatchMessageA
TranslateMessage
GetMessageA
EnableWindow
SetWindowLongA
CallWindowProcA
EnumChildWindows

gdi32

MoveToEx
CreateBitmap
ExtCreateRegion
SetDIBits
CreateBitmapIndirect
StretchDIBits
SetWorldTransform
SetGraphicsMode
GetDeviceCaps
SetStretchBltMode
GetCurrentObject
CreateRectRgn
CombineRgn
GetTextMetricsA
SetTextAlign
SetTextColor
AddFontResourceA
RemoveFontResourceA
CreateFontIndirectA
SetBkMode
CreateHatchBrush
Polygon
LineDDA
CreateBrushIndirect
CreatePolygonRgn
FillRgn
Ellipse
SetROP2
LineTo
SetPixel
ExtCreatePen
GetStockObject
Arc
CreatePen
RoundRect
CreateRoundRectRgn
FrameRgn
CreateSolidBrush
PatBlt
StretchBlt
GetPixel
GetObjectA
GetDIBits
DeleteObject
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
ExtTextOutA
SetBkColor

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey

shell32

ExtractIconA
Shell_NotifyIconA

winmm

mmioGetInfo
mmioAdvance
mmioSetInfo
mmioSeek
mmioOpenA
mmioClose
PlaySoundA
mmioDescend
mmioRead
mmioAscend

msimg32

TransparentBlt
AlphaBlend
GradientFill

wininet

InternetOpenA
FtpCreateDirectoryA
FtpDeleteFileA
FtpPutFileA
InternetConnectA
InternetCloseHandle
FtpOpenFileA
FtpGetFileSize
InternetReadFile

ws2_32

WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup
closesocket
sendto
setsockopt
socket
inet_addr
htons

gdiplus

GdiplusStartup
GdiplusShutdown
GdipCreatePen1
GdipDeletePen
GdipSetPenStartCap
GdipSetPenEndCap
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipFillRectangleI
GdipDrawRectangleI
GdipDrawEllipseI
GdipFillEllipseI
GdipResetPath
GdipClosePathFigure
GdipAddPathArcI
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipFillPath
GdipFillPolygonI
GdipCreateHatchBrush
GdipDrawArcI
GdipLoadImageFromFile
GdipDisposeImage
GdipDrawImageRect
GdipGetImageHeight
GdipGetImageWidth
GdipSetPenLineCap197819
GdipGetSmoothingMode
GdipSetInterpolationMode
GdipDrawImageRectRect
GdipCreateBitmapFromHBITMAP
GdipCloneImage

dsound

ord1

ole32

CoUninitialize
CoInitialize

Sections

.textbss
Size: - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 966KB - Virtual size: 966KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 479KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c06f076cbdae138141d0e43af151f71c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

winmm

msimg32

wininet

ws2_32

gdiplus

dsound

ole32

Sections

.textbss Size: - Virtual size: 464KB

.text Size: 966KB - Virtual size: 966KB

.rdata Size: 72KB - Virtual size: 72KB

.data Size: 479KB - Virtual size: 1.1MB

.idata Size: 11KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 43KB - Virtual size: 43KB

.textbss
Size: - Virtual size: 464KB

.text
Size: 966KB - Virtual size: 966KB

.rdata
Size: 72KB - Virtual size: 72KB

.data
Size: 479KB - Virtual size: 1.1MB

.idata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 43KB - Virtual size: 43KB