e6ee52f8904cf80b48007f11b1d1f230N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

e6ee52f8904cf80b48007f11b1d1f230N.exe
Size

656KB
MD5

e6ee52f8904cf80b48007f11b1d1f230
SHA1

efd4bc3ea3b43dcd25bed18da3e77aea2b7849e4
SHA256

9b9a5be924d7b022d352bfdef50803781ef0f36e3c71154b1366c22d3d0ffb91
SHA512

bb2e45cdecf6612aa9c711dc0f0d9a810108cfd9d9aa1b3159f0a1b98ec0e44e28f32401d370a74ee36ead9a2a84b97fe1f76327db7b51c58aa1aefd51ee0329
SSDEEP

6144:BYlT0wDQOCMkJ9zIg7x2NmP9IrlIZqHSSYCu5TEGI6/Ixz8t+LnAa049s8Z:qmwDcMkXVTyrlIZE0TEw/ImYnJ/W0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e6ee52f8904cf80b48007f11b1d1f230N.exe

Files

e6ee52f8904cf80b48007f11b1d1f230N.exe
.dll windows:4 windows x86 arch:x86

5af0b11687bcd81dbcb5be47d2b1886f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\WORK2005\JMX_CommonServers\Tools\ServiceManager\Plugins\ConcurrentUserLog\ConcurrentUserLog___Win32_Release_SR_VIETNAM\ConcurrentUserLog.pdb

Imports

kernel32

InterlockedExchange
GetACP
GetThreadLocale
GetLocaleInfoA
GetVersionExA
lstrlenA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoW
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
VirtualAlloc
HeapReAlloc
FatalAppExitA
IsValidCodePage
GetOEMCP
GetCPInfo
GetTimeZoneInformation
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetUserDefaultLangID
GetTimeFormatA
GetDateFormatA
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareStringA
lstrcmpiA
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
DeleteCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
ReleaseSemaphore
CloseHandle
WaitForSingleObject
InitializeCriticalSection
GetCurrentProcess
FreeLibrary
GetModuleFileNameA
GetLocalTime
CreateFileA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
IsDebuggerPresent
ExitProcess
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
InterlockedDecrement
GetSystemInfo
GlobalMemoryStatus
ResetEvent
GetTickCount
CreateEventA
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetEvent
CreateDirectoryA
FlushFileBuffers
SetFilePointer
SetEndOfFile
GetFileSize
ReadFile
WriteFile
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingA
MapViewOfFile
GetLastError
SleepEx
FlushInstructionCache
SetThreadPriority
ResumeThread
SuspendThread
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ExitThread
CreateThread
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
HeapSize
SetHandleCount
GetStdHandle
GetFileType

user32

GetParent
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetDesktopWindow
CreateDialogParamA
DialogBoxParamA
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
EndDialog
EnableWindow
EnumChildWindows
MessageBoxA
GetClassNameA
TrackPopupMenu
GetCursorPos
AppendMenuA
DestroyMenu
CreatePopupMenu
GetWindowTextA
SetWindowTextA
GetDlgItem
ShowWindow
SetWindowPos
PostQuitMessage
DestroyWindow
CreateWindowExA
RegisterClassA
DefWindowProcA
MoveWindow
GetWindowLongA
PeekMessageA
TranslateMessage
DispatchMessageA
UpdateWindow
GetWindowRect
GetClientRect
AdjustWindowRect
GetSystemMetrics
RedrawWindow
SendMessageA

ws2_32

inet_ntoa
ntohs
htons
WSACreateEvent
getsockname
bind
connect
accept
getpeername
getsockopt
WSASend
closesocket
WSASocketA
WSAGetLastError
listen
shutdown
WSAIoctl
WSARecv
setsockopt
WSASendTo
WSARecvFrom
WSAStartup
WSACleanup
ioctlsocket
gethostbyname
inet_addr
socket
WSACloseEvent
WSAWaitForMultipleEvents
WSAResetEvent
WSAGetOverlappedResult
WSASetEvent

iphlpapi

GetAdaptersInfo

gdi32

CreateFontA

ole32

CoCreateGuid

Exports

Exports

?CreatePlugin@@YA_NPAUsPluginCreateInfo@@@Z

Sections

.text
Size: 432KB - Virtual size: 429KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 536KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5af0b11687bcd81dbcb5be47d2b1886f

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

ws2_32

iphlpapi

gdi32

ole32

Exports

Exports

Sections

.text Size: 432KB - Virtual size: 429KB

.rdata Size: 68KB - Virtual size: 64KB

.data Size: 16KB - Virtual size: 536KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 20KB

.text Size: 108KB - Virtual size: 108KB

.text
Size: 432KB - Virtual size: 429KB

.rdata
Size: 68KB - Virtual size: 64KB

.data
Size: 16KB - Virtual size: 536KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 20KB

.text
Size: 108KB - Virtual size: 108KB