84686660221db5ee17dde608992a59176e31459ee18f243525ad2ea739edd7d3

Sharing

Copy URL Twitter E-mail

General

Target

84686660221db5ee17dde608992a59176e31459ee18f243525ad2ea739edd7d3
Size

2.4MB
MD5

efeb8bd8c6ed8cc80fff9c8f64bfa0fa
SHA1

18f7c2c35969ddff01ef7f03a58b421cee9e9c90
SHA256

84686660221db5ee17dde608992a59176e31459ee18f243525ad2ea739edd7d3
SHA512

9fcad2a362b74b20f35ecd0c15b1d60991632f2ca4ab0bd5fd3f2a551a708a796304884d9ce88eab97480f0cfea6012d7f1e474e6ea015ba95da93200817ef01
SSDEEP

49152:Ggu+W6rE7Xp2kosA3gQC/QTiPIXn6iAaNuyFYOKepA:i+W6rETpeJ3L/XnVAam

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84686660221db5ee17dde608992a59176e31459ee18f243525ad2ea739edd7d3

Files

84686660221db5ee17dde608992a59176e31459ee18f243525ad2ea739edd7d3
.exe windows:5 windows x86 arch:x86

8db8014794402b36087880b3566c9471

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAddBackslashW
SHDeleteKeyW

kernel32

HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GlobalFree
LocalAlloc
VirtualAlloc
VirtualFree
GetCurrentThreadId
WaitForSingleObject
Sleep
GetModuleHandleW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetVolumeInformationW
GetSystemInfo
GetTickCount
GetVersionExW
CreateMutexW
EnterCriticalSection
LeaveCriticalSection
DeviceIoControl
OutputDebugStringA
SetPriorityClass
DeleteFiber
CreateDirectoryW
GetDriveTypeW
GetEnvironmentVariableW
GetLogicalDriveStringsW
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
DecodePointer
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
GetLongPathNameW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
GetFileAttributesExW
SetFileAttributesW
CreateFileW
lstrcpyW
FileTimeToSystemTime
ReadFile
WriteFile
GetFileSize
GetCurrentProcess
GetCurrentProcessId
FormatMessageW
GetLastError
LocalFree
GetPrivateProfileStringW
TerminateProcess
OpenProcess
GetTempPathW
CreateThread
lstrlenW
MoveFileExW
FindNextFileW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
SwitchToFiber
GetModuleHandleExW
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetCommandLineA
WTSGetActiveConsoleSessionId
FindClose
GetSystemDirectoryW
LoadLibraryW
CloseHandle
GetProcAddress
FreeLibrary
ReleaseMutex
GetStdHandle
GetFileType
WaitForMultipleObjects
SleepEx
InitializeCriticalSection
GetUserDefaultLCID
IsValidLocale
FormatMessageA
GetConsoleCP
GetACP
SetConsoleCtrlHandler
ExitProcess
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
ExitThread
RtlUnwind
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
SetEvent
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SystemTimeToFileTime
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
SwitchToThread
GetCurrentThread
EncodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateFiber

user32

LoadStringW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
wsprintfW

advapi32

OpenProcessToken
ReportEventW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyW
DuplicateTokenEx
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
RegEnumKeyW
RegDeleteKeyExW
RegCreateKeyExA
RegQueryValueExW
RegDeleteKeyW
RegCreateKeyExW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
CloseServiceHandle
RegSetValueExW
RegisterEventSourceW

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

crypt32

CertCloseStore
CryptMsgClose
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertFindCertificateInStore
CryptMsgGetParam

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

wldap32

ord32
ord46
ord211
ord60
ord301
ord200
ord30
ord79
ord35
ord33
ord143
ord27
ord26
ord22
ord41
ord50

ws2_32

WSACleanup
send
WSAStartup
WSAGetLastError
__WSAFDIsSet
gethostname
ioctlsocket
select
WSASetLastError
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
recv

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 531KB - Virtual size: 531KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 19KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8db8014794402b36087880b3566c9471

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

crypt32

psapi

wldap32

ws2_32

wtsapi32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 531KB - Virtual size: 531KB

.data Size: 19KB - Virtual size: 44KB

.rsrc Size: 168KB - Virtual size: 168KB

.reloc Size: 140KB - Virtual size: 140KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 531KB - Virtual size: 531KB

.data
Size: 19KB - Virtual size: 44KB

.rsrc
Size: 168KB - Virtual size: 168KB

.reloc
Size: 140KB - Virtual size: 140KB