c1aca3b71ffd1850bc0e36c419cc8a0e2bc6a84196b0506d3d7851a2e0bd3ee0

Sharing

Copy URL Twitter E-mail

General

Target

c1aca3b71ffd1850bc0e36c419cc8a0e2bc6a84196b0506d3d7851a2e0bd3ee0
Size

138KB
MD5

cf583ca52bc70bd4d5852e25b5e3451d
SHA1

5f4aaaf723a3b856676dd1a6f69215d111110ffe
SHA256

c1aca3b71ffd1850bc0e36c419cc8a0e2bc6a84196b0506d3d7851a2e0bd3ee0
SHA512

51148d7d0574f6266ebfe4551028d9e5297fd4f9e896edfb17f2bad5485efb716226a09c01e66b94a80fa6156295437d78f3e863980db222a8b4cbb9267c6fbc
SSDEEP

3072:7tsaTXr2uHKP/BDzh/5jrCIHer7Zmv3HSruNyLamWjMAKdWrc:7Garr2uHKPfYJmaiNyVWPdrc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1aca3b71ffd1850bc0e36c419cc8a0e2bc6a84196b0506d3d7851a2e0bd3ee0

Files

c1aca3b71ffd1850bc0e36c419cc8a0e2bc6a84196b0506d3d7851a2e0bd3ee0
.exe windows:5 windows x86 arch:x86

90fb8039802dcd9312961c1119ffea1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
SetEvent
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
CreateEventW
GlobalLock
GlobalUnlock
GetThreadContext
SetThreadContext
GetProcessId
GetFileAttributesExW
GetPrivateProfileStringW
GetPrivateProfileIntW
MapViewOfFile
Thread32Next
SetThreadPriority
ReleaseMutex
GetCurrentThreadId
TlsAlloc
TlsFree
GetNativeSystemInfo
GetVersionExW
lstrcmpiA
TlsGetValue
TlsSetValue
TerminateProcess
ExitProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
WTSGetActiveConsoleSessionId
GetLocalTime
MoveFileExW
GetUserDefaultUILanguage
CreateRemoteThread
Process32FirstW
Process32NextW
GetFileAttributesW
GetFileTime
CreateToolhelp32Snapshot
VirtualProtect
FindNextFileW
lstrcmpiW
WaitForMultipleObjects
RemoveDirectoryW
LoadLibraryA
FindClose
HeapCreate
HeapDestroy
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
GetProcAddress
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
CreateFileMappingW
ReadFile
ReadProcessMemory
Sleep
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
GetModuleHandleW
WaitForSingleObject
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
UnmapViewOfFile
GetEnvironmentVariableW

user32

CharLowerBuffA
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
CharLowerW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
SetCapture
HiliteMenuItem
RegisterClassW
GetUserObjectInformationW
SendMessageW
CallWindowProcA
GetWindowRect
GetParent
GetWindowDC
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
MapWindowPoints
DrawIcon
GetIconInfo
ExitWindowsEx
MapVirtualKeyW
FillRect
PostMessageW
GetWindowInfo
DrawEdge
IntersectRect
EqualRect
PrintWindow
IsRectEmpty
EndPaint
GetMessageA
GetUpdateRgn
BeginPaint
GetUpdateRect
SetThreadDesktop
GetCapture
GetMessageW
GetClassNameW
SetCursorPos
OpenWindowStationW
PeekMessageA
GetCursorPos
DispatchMessageW
GetWindow
ReleaseCapture
GetMessagePos
CreateDesktopW
SetProcessWindowStation
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
GetSystemMetrics
GetKeyboardState
GetClipboardData
ToUnicode
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
DefMDIChildProcA
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
CharLowerA
GetWindowLongW
TranslateMessage
GetDCEx

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
IsWellKnownSid
GetLengthSid
RegEnumKeyExW
EqualSid
InitiateSystemShutdownExW

shlwapi

wvnsprintfW
PathIsURLW
PathQuoteSpacesW
StrCmpNIW
StrStrIW
StrStrIA
PathRenameExtensionW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
DeleteDC
GdiFlush
SetViewportOrgEx
CreateCompatibleDC
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
SetRectRgn
CreateCompatibleBitmap

ws2_32

WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
WSAEventSelect
recvfrom
sendto
getpeername
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90fb8039802dcd9312961c1119ffea1e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB