36064bd52b2eb870782b97a9e389c60c83821af4fb3788f9c561093477a306d5

Sharing

Copy URL Twitter E-mail

General

Target

36064bd52b2eb870782b97a9e389c60c83821af4fb3788f9c561093477a306d5
Size

460KB
MD5

db8d03097836038db00d1db1ff42e5fa
SHA1

2d5206d5a997eccc54ac230cc36243c18a92d19f
SHA256

36064bd52b2eb870782b97a9e389c60c83821af4fb3788f9c561093477a306d5
SHA512

ccfcab84740e348797e87d9427d69acdcfbe59b5016807f158e29adaf0ef3be51c8ce09c602a5faf5aae512276cf6bf7f10a26c458da921dffd6691eefeed77a
SSDEEP

3072:LL/nmLiFthEhJkfEL0BT9CjRQFaU3jwy9ovBvu:LL/KijhYJkfEL0BTAUzSu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36064bd52b2eb870782b97a9e389c60c83821af4fb3788f9c561093477a306d5

Files

36064bd52b2eb870782b97a9e389c60c83821af4fb3788f9c561093477a306d5
.exe windows:4 windows x86 arch:x86

daa1ca79b0a073fd6833fae491b163f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
CreateFileW
SetFilePointer
FlushFileBuffers
SetEndOfFile
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
ExitProcess
TerminateProcess
HeapFree
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetStringTypeA
GetStringTypeW
GetCPInfo
CompareStringA
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
GetProcessVersion
GlobalAddAtomW
GlobalFindAtomW
GetModuleHandleW
GetModuleHandleA
lstrcpyW
lstrcatW
WritePrivateProfileStringW
GetModuleFileNameW
GlobalFlags
lstrcmpiW
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetVersion
InitializeCriticalSection
lstrcpynW
SetLastError
GlobalLock
lstrcmpW
GlobalAlloc
InterlockedExchange
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
LocalFree
lstrlenA
lstrlenW
InterlockedDecrement
InterlockedIncrement
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
CreateSemaphoreW
CreateThread
WaitForSingleObject
ReleaseMutex
GetSystemInfo
GetVersionExW
GetComputerNameW
WideCharToMultiByte
MultiByteToWideChar
ReleaseSemaphore
PeekNamedPipe
WriteFile
Sleep
GetSystemDirectoryW
CreatePipe
GetStartupInfoW
CreateProcessW
ReadFile
GetLastError
OpenProcess
HeapDestroy
CloseHandle

user32

CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
LoadIconW
ShowWindow
LoadCursorW
GetSysColorBrush
DestroyMenu
GetSubMenu
GetMenuItemID
GetDlgItem
DefWindowProcW
DestroyWindow
CreateWindowExW
SetPropW
GetPropW
CallWindowProcW
RemovePropW
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
SetWindowLongW
SetWindowPos
RegisterWindowMessageW
GetTopWindow
SystemParametersInfoW
IsIconic
GetWindowPlacement
GetSystemMetrics
GrayStringW
DrawTextW
TabbedTextOutW
ReleaseDC
GetDC
GetMenuItemCount
GetLastActivePopup
IsWindowEnabled
MessageBoxW
EnableWindow
GetWindowTextW
SetWindowTextW
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetWindowLongW
GetClassNameW
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
SetCursor
GetMessageW
TranslateMessage
DispatchMessageW
GetCapture
WinHelpW
GetClassInfoW
wsprintfW
PostQuitMessage
GetActiveWindow
SendMessageW
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageW
GetCursorPos
SetWindowsHookExW
LoadStringW
UnhookWindowsHookEx
PostMessageW
RegisterClassW
GetMenu

gdi32

SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SetTextColor
GetDeviceCaps
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
GetObjectW
SetBkColor
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
DeleteObject

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegSetValueExW
GetUserNameW
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

comctl32

ord17

ws2_32

ntohs
gethostbyaddr
WSAGetLastError
inet_addr
htons
getservbyname
htonl
WSASetLastError
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_ntoa
getservbyport

wininet

InternetQueryOptionW
HttpOpenRequestA
InternetConnectA
InternetReadFile
InternetOpenW
InternetSetOptionW
InternetCloseHandle
HttpSendRequestA

psapi

EnumProcesses
GetModuleBaseNameW
EnumProcessModules

Sections

.text
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

daa1ca79b0a073fd6833fae491b163f6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

ws2_32

wininet

psapi

Sections

.text Size: 92KB - Virtual size: 89KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 160B

.shell Size: 320KB - Virtual size: 320KB

.text
Size: 92KB - Virtual size: 89KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 160B

.shell
Size: 320KB - Virtual size: 320KB