2f23a0d27325ad2119efc20c91ecc10ad80fd55ff1b3ae71f940b36d226f34f4

Sharing

Copy URL Twitter E-mail

General

Target

2f23a0d27325ad2119efc20c91ecc10ad80fd55ff1b3ae71f940b36d226f34f4
Size

528KB
MD5

b970cc3d15aa3dcc1b133002282ba731
SHA1

e38aa078734de8eb4186d32d2ce655e0d8f797b7
SHA256

2f23a0d27325ad2119efc20c91ecc10ad80fd55ff1b3ae71f940b36d226f34f4
SHA512

c03bdc53406e1f1a3b6ec00eb2378675a3c003c37d1a67bb9e477725a13e2cdd7ffe004b3c390985f65530810b5d568fef16e5157a24af3d7ef3c3823baa5eae
SSDEEP

6144:tRHczbCTZoOEYyjpq04Or/6GHdoEnTwjhopmyK32+F23GYdF/:+bMZoOEDttf/g2vg21/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f23a0d27325ad2119efc20c91ecc10ad80fd55ff1b3ae71f940b36d226f34f4

Files

2f23a0d27325ad2119efc20c91ecc10ad80fd55ff1b3ae71f940b36d226f34f4
.exe windows:5 windows x86 arch:x86

324eae7f19890b5c58aadd2591fcc750

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_ntoa
ntohs
htons
inet_addr

winmm

waveInOpen
mixerGetControlDetailsA
waveInGetNumDevs
waveInGetDevCapsA
mixerGetLineControlsA
mixerGetLineInfoA
waveInClose
waveInUnprepareHeader
waveInReset
waveInAddBuffer
waveInStart
waveInPrepareHeader
mixerOpen
mixerClose
mixerSetControlDetails

cfgmgr32

CM_Enumerate_Classes

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiClassGuidsFromNameA
SetupDiGetClassImageList
SetupDiDestroyDeviceInfoList
SetupDiOpenClassRegKeyExA
SetupDiGetClassDevsA
SetupDiGetClassImageIndex
SetupDiClassNameFromGuidA

kernel32

LoadLibraryA
lstrcmpA
Sleep
GetSystemDirectoryA
GetLogicalDriveStringsA
HeapAlloc
GetProcessHeap
FindClose
FindNextFileA
FindFirstFileA
SetErrorMode
GetComputerNameA
GetCurrentDirectoryA
SetEvent
VirtualAlloc
CloseHandle
CreateThread
VirtualFree
TerminateThread
SetThreadPriority
ResumeThread
WaitForSingleObject
CreateEventA
PulseEvent
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ResetEvent
DeviceIoControl
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThreadId
GetSystemInfo
CompareStringW
CreateFileA
CreateFileW
GetSystemDirectoryW
DeleteFileA
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryW
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
GlobalHandle
GlobalReAlloc
SetFilePointer
SetEndOfFile
GetFileSize
ReadFile
WriteFile
HeapFree
HeapReAlloc
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
QueryPerformanceCounter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError

user32

GetSystemMetrics
GetDesktopWindow
GetDC
ReleaseDC
wsprintfA
GetMessageA

gdi32

CreateCompatibleDC
CreateDIBSection
BitBlt
DeleteDC
SelectObject
DeleteObject

advapi32

OpenSCManagerW
SetServiceStatus
RegQueryValueA
RegCloseKey
RegOpenKeyA
RegEnumKeyA
RegQueryValueExA
QueryServiceConfigW
CreateServiceW
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
OpenServiceW
UnlockServiceDatabase
LockServiceDatabase
CloseServiceHandle
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegEnumKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExA
RegQueryInfoKeyA

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysStringLen
SysAllocString

msvcp90

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

msvcr90

__getmainargs
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
remove
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
??_V@YAXPAX@Z
memcpy
memset
memmove
feof
fread
_itoa
_snprintf
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
exit
strtoul
realloc
strncpy_s
_vsnwprintf
_purecall
_vsnprintf
strncpy
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_mbsicmp
_CxxThrowException
free
malloc
fclose
fopen
fwrite
memmove_s

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

324eae7f19890b5c58aadd2591fcc750

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

winmm

cfgmgr32

setupapi

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp90

msvcr90

Sections

.text Size: 65KB - Virtual size: 64KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 120KB - Virtual size: 121KB

.rsrc Size: 1024B - Virtual size: 688B

.shell Size: 320KB - Virtual size: 320KB

.text
Size: 65KB - Virtual size: 64KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 120KB - Virtual size: 121KB

.rsrc
Size: 1024B - Virtual size: 688B

.shell
Size: 320KB - Virtual size: 320KB