0d667859b3583a6cc2f51b3cbe582a1caea8498b1657f06acf4ba49180aec979

Sharing

Copy URL Twitter E-mail

General

Target

0d667859b3583a6cc2f51b3cbe582a1caea8498b1657f06acf4ba49180aec979
Size

624KB
MD5

806f6b6984b6ff0d3250f3391b70da35
SHA1

1631b15f670068f2db6a0354d007c62f2369db55
SHA256

0d667859b3583a6cc2f51b3cbe582a1caea8498b1657f06acf4ba49180aec979
SHA512

8af460b4a725cbbb93cadee63c62a1c7b361b1a186c5d06c934480c285506109ac99543e43d7f8db60b67727fdc66df7f5259087faf84af3830f8b240efafe2c
SSDEEP

6144:B6EQd7Yl0ooomZYloYl9SaG6GnxaKloTvKpDWWUMm:ed7Y+ZomClodaG6GxaK2Uo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d667859b3583a6cc2f51b3cbe582a1caea8498b1657f06acf4ba49180aec979

Files

0d667859b3583a6cc2f51b3cbe582a1caea8498b1657f06acf4ba49180aec979
.exe windows:4 windows x86 arch:x86

a07dc157e35ca028206540c134375a26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileW
GetDiskFreeSpaceExW
GetCurrentProcess
GetProcAddress
MoveFileW
GetFileAttributesW
LocalAlloc
CreateFileA
GetModuleFileNameA
SetFilePointerEx
SetFilePointer
GetDriveTypeW
GetLogicalDrives
GetWindowsDirectoryW
SetFileAttributesW
GetComputerNameA
GetModuleFileNameW
LoadLibraryW
GetLastError
CopyFileW
FindNextFileW
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
FindClose
GetTickCount
GetCurrentThreadId
GetFileSize
ReadFile
DeleteFileW
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
GlobalUnlock
GetTempPathW
CreateFileW
WriteFile
CreateProcessW
Sleep
CreateThread
WaitForSingleObject
CloseHandle
SetUnhandledExceptionFilter
MultiByteToWideChar
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
ExitProcess
TerminateProcess
RtlUnwind
InterlockedDecrement
InterlockedIncrement
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection

user32

SystemParametersInfoW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
RegisterClassExW
LoadCursorW
UpdateWindow
ShowWindow
CreateWindowExW
PostQuitMessage
EndPaint
DrawTextW
GetClientRect
EndDialog
DefWindowProcW
DestroyWindow
DialogBoxParamW
BeginPaint

advapi32

ChangeServiceConfig2W
StartServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
LookupPrivilegeValueW
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserW
OpenSCManagerW
ControlService
DeleteService
OpenSCManagerA
OpenServiceW
CreateServiceW
CloseServiceHandle
QueryServiceStatus
StartServiceA
StartServiceCtrlDispatcherW

shell32

SHGetSpecialFolderPathW

ws2_32

inet_addr
closesocket
setsockopt
select
connect
ioctlsocket
WSAGetLastError
socket
shutdown
send
htons
gethostbyname
WSAStartup

shlwapi

PathFindExtensionW
StrStrIA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

netapi32

NetShareEnum
NetApiBufferFree

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a07dc157e35ca028206540c134375a26

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

shlwapi

userenv

netapi32

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 37KB

.rsrc Size: 232KB - Virtual size: 230KB

.shell Size: 320KB - Virtual size: 320KB

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 37KB

.rsrc
Size: 232KB - Virtual size: 230KB

.shell
Size: 320KB - Virtual size: 320KB