9ea4736be2727f13528df7223b58c810N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

9ea4736be2727f13528df7223b58c810N.exe
Size

613KB
MD5

9ea4736be2727f13528df7223b58c810
SHA1

dfa23a4a63a3fbc595181c7d9cb672d77a9c3d6c
SHA256

780783b64de61caef8c4c5cc424cd875e919deec11cf2136a8c92380ba5bcabd
SHA512

5c1a808aebb64b908ed6b940b1a40ad736b09609596fbdaee8bddac17de4da778c04ad66ed7981ab2c8d95c5f092cbe0b72618b8980e87fa0243d10540e13353
SSDEEP

6144:VgSLV7eg0PF4a0bz7NZKd0kyXGHpgwl+Btm3sX5KNo6T/DWlfQksrmwRs5TgpTKw:Vgqo2ZE6XGHwm25ZuaGrmwRsmmuHSCd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ea4736be2727f13528df7223b58c810N.exe

Files

9ea4736be2727f13528df7223b58c810N.exe
.dll regsvr32 windows:10 windows x86 arch:x86

6a3cf26e6f7821c972ab1c02b9ecd997

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mqsnap.pdb

Imports

mfc42u

ord5303
ord4692
ord4074
ord5298
ord5296
ord3341
ord2388
ord3917
ord5727
ord2546
ord6371
ord3605
ord656
ord4270
ord3614
ord2406
ord3621
ord1634
ord5142
ord860
ord3714
ord793
ord2293
ord2356
ord2287
ord3133
ord4294
ord2281
ord941
ord539
ord5677
ord2809
ord926
ord859
ord3092
ord2507
ord3494
ord6484
ord2876
ord3470
ord6655
ord536
ord826
ord269
ord600
ord1240
ord1571
ord1250
ord1568
ord1570
ord342
ord1179
ord1248
ord1115
ord1194
ord1563
ord1197
ord2116
ord6195
ord1594
ord2821
ord3993
ord3991
ord6485
ord5949
ord1145
ord2914
ord2910
ord6456
ord561
ord5193
ord1089
ord2504
ord4480
ord1143
ord5710
ord4219
ord2235
ord355
ord942
ord2036
ord2440
ord5830
ord4371
ord3396
ord540
ord800
ord6466
ord4616
ord3733
ord1128
ord2717
ord3948
ord815
ord324
ord2822
ord1155
ord1165
ord1662
ord2385
ord2644
ord1560
ord268
ord1196
ord2606
ord3658
ord6390
ord326
ord4229
ord1808
ord4848
ord4992
ord2506
ord6048
ord4073
ord1767
ord4508
ord6481
ord2371
ord4253
ord6593
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5283
ord3793
ord4829
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord5273
ord2977
ord5446
ord2099
ord6928
ord6379
ord5436
ord768
ord2362
ord4155
ord3087
ord6330
ord861
ord2820
ord2634
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3142
ord3254
ord4459
ord3131
ord5285
ord5977
ord924
ord6238
ord3088
ord2859
ord4272
ord4273
ord5679
ord4370
ord5276
ord4847
ord2637
ord2350
ord2291
ord2284
ord2854
ord2756
ord6218
ord5568
ord5268
ord5267
ord927
ord537
ord3332
ord3312
ord4124
ord6279
ord6278
ord5706
ord2755
ord3577
ord4392
ord2570
ord4213
ord2015
ord2403
ord4704
ord6024
ord2357
ord2290
ord6483
ord4709
ord6584
ord5284
ord4433
ord2046
ord3381
ord4425
ord6740
ord2520
ord6564
ord6525
ord693
ord3635
ord3365
ord4396
ord2574
ord2729
ord3798
ord3871
ord692
ord3634
ord4395
ord2573
ord4214
ord2016
ord2405
ord6362
ord1764
ord3569
ord4390
ord2567
ord795
ord567
ord3716
ord4418
ord3397
ord4831
ord5286
ord1768
ord6051
ord6211
ord940
ord925
ord922
ord535
ord858
ord641
ord616
ord609
ord4199
ord2836
ord2294
ord5155
ord5156
ord5154
ord4899
ord4736
ord4970
ord4942
ord4352
ord2078
ord5261

msvcrt

memcmp
__RTDynamicCast
__CxxFrameHandler3
_vsnwprintf
memcpy_s
_vsnprintf_s
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memmove
memmove_s
wcsnlen
_purecall
malloc
_wcsicmp
free
realloc
?what@exception@@UBEPBDXZ
_itow_s
memcpy
??0exception@@QAE@ABV0@@Z
swscanf_s
_ui64tow_s
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
memset
iswdigit
_snwscanf_s
towupper
wcstol
_wtoi
wcstoul
wcscspn
??0exception@@QAE@ABQBD@Z
wcschr
iswspace
isalpha
qsort
_wcsnicmp
_strnicmp
_wcsdup

mqsec

?Add@CColumns@@QAEXABK@Z
??1CColumns@@QAE@XZ
??0CColumns@@QAE@I@Z
SetFalconKeyValue
GetFalconKeyValue
MQSec_GetAnonymousSid
MQSec_GetWorldSid
GetComputerNameInternal
IsLocalSystemCluster
??0CRestriction@@QAE@I@Z
??1CRestriction@@QAE@XZ
?AddRestriction@CRestriction@@QAEXPAU_GUID@@KK@Z
MQSec_GetAdminSid
MQSec_SetDirectorySecurityForService
MQSec_SetPrivilegeInThread
MQSec_GetProcessUserSid
MQSigCreateCertificate
MQSec_StorePubKeysInDS
GetDomainFQDNName
MSMQGetOperatingSystem
MQSec_GetUserType

mqutil

MQGetResourceHandle

mqrt

MQReceiveMessage
MQFreeMemory
RTRemoveUserCert
RTRemoveUserCertSid
MQGetQueueProperties
MQMgmtGetInfo
MQMgmtAction
MQGetMachineProperties
MQBeginTransaction
MQMoveMessage
MQDeleteQueue
MQGetQueueSecurity
MQSetQueueProperties
MQCreateCursor
MQOpenQueue
RTDeleteInternalCert
RTRegisterUserCert
RTGetInternalCert
RTCreateInternalCertificate
RTIsDependentClient
MQSetQueueSecurity
MQPathNameToFormatName
MQPurgeQueue
MQCreateQueue
MQCloseQueue
MQSendMessage
MQReceiveMessageByLookupId
RTGetUserCerts
MQCloseCursor

mqcertui

SelectPersonalCertificateForRemoval
SelectPersonalCertificateForRegister
ShowCertificate
ShowPersonalCertificates

kernel32

VirtualAlloc
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
OutputDebugStringA
GetModuleFileNameW
LoadLibraryW
LoadLibraryExW
GetModuleHandleA
lstrcpynW
CreateSemaphoreExW
LeaveCriticalSection
CreateMutexExW
GetCurrentProcessId
CreateThreadpoolTimer
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
SetLastError
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
GetLastError
InitializeCriticalSectionAndSpinCount
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
FormatMessageW
CloseHandle
LoadLibraryA
LocalAlloc
ExpandEnvironmentStringsW
FindClose
GetFileAttributesW
GetDriveTypeW
CreateDirectoryW
RemoveDirectoryW
FindFirstFileW
MoveFileW
FindNextFileW
OpenProcess
Sleep
GetComputerNameW
VirtualFree
LoadLibraryExA
EncodePointer
DecodePointer
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
lstrlenA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
RaiseException
GetCurrentProcess
InitializeCriticalSection
HeapDestroy
lstrcpyW
GlobalFree
GetModuleHandleW
LockResource
GetDateFormatW
GetTimeFormatW
CompareStringW
GetProcAddress
GlobalAlloc
LocalFree

user32

CharNextW
LoadStringW
RegisterClipboardFormatW
GetDlgItem
SendMessageW
GetWindowLongW
GetParent
GetWindowRect
GetClientRect
SetWindowLongW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
LoadImageW
LoadMenuW
GetSubMenu
GetMenuItemInfoW
DestroyMenu
PostMessageW
IsWindow
InsertMenuW
SetWindowTextW
GetDC
ReleaseDC
LoadIconW
ScreenToClient
SetDlgItemTextW
GetDlgItemTextW
SetActiveWindow
BringWindowToTop
FindWindowExW
GetWindowThreadProcessId
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx

oleaut32

VarI4FromStr
SysFreeString
SysStringLen
SysAllocStringLen
GetErrorInfo
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
RegisterTypeLi
LoadTypeLi
VariantInit
VariantClear
SysAllocString

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemFree
IIDFromString
StringFromGUID2
OleRun
CoInitialize
CLSIDFromProgID

advapi32

RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
MakeSelfRelativeSD
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
TraceMessage
CopySid
OpenProcessToken
GetSecurityDescriptorDacl
GetAclInformation
GetAce
RegCreateKeyExW
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertSidToStringSidW
LookupAccountSidW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetSecurityDescriptorLength
MapGenericMask
GetFileSecurityW
InitiateSystemShutdownExW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatusEx
QueryServiceStatus
ControlService
EnumDependentServicesW
StartServiceW
TraceEvent
IsValidSid
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW

gdi32

GetTextExtentPoint32W
DeleteObject
CreateFontIndirectW

aclui

ord1

activeds

ord9
ord18
ord20

crypt32

CertCloseStore
CertOpenStore

netapi32

NetApiBufferFree
DsGetDcNameW

ntdsapi

DsFreeNameResultW
DsCrackNamesW

cryptui

CryptUIDlgSelectCertificateFromStore

clusapi

CloseClusterNode
CloseCluster
OpenCluster
OpenClusterNode

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 432KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a3cf26e6f7821c972ab1c02b9ecd997

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc42u

msvcrt

mqsec

mqutil

mqrt

mqcertui

kernel32

user32

oleaut32

ole32

advapi32

gdi32

aclui

activeds

crypt32

netapi32

ntdsapi

cryptui

clusapi

Exports

Exports

Sections

.text Size: 432KB - Virtual size: 432KB

.data Size: 15KB - Virtual size: 31KB

.idata Size: 11KB - Virtual size: 11KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 53KB - Virtual size: 53KB

.text
Size: 432KB - Virtual size: 432KB

.data
Size: 15KB - Virtual size: 31KB

.idata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 53KB - Virtual size: 53KB