e4cd8e9d3f58fb075f157a516ee1f058f0d44305b3689ff3b390aa0a40bfaa7d

Sharing

Copy URL Twitter E-mail

General

Target

e4cd8e9d3f58fb075f157a516ee1f058f0d44305b3689ff3b390aa0a40bfaa7d
Size

1.3MB
MD5

e5d520ce58dc9d059a913ed391be3044
SHA1

8ec3c3ff5e77c9b30b0c74aee1c631117bc749c7
SHA256

e4cd8e9d3f58fb075f157a516ee1f058f0d44305b3689ff3b390aa0a40bfaa7d
SHA512

4589f7c8c72f13f3bd24b8c39c267b0b147762b2c6115da585c7b7110efdb4034408491faacf83645626862833301f37163ee62e387ae53e467bef2f512ef472
SSDEEP

24576:vHsmd2HRWRakgrpjwjocaZwhmuz5VoOyUEI50naBbobawBh2hj:uFkgrxwwZ8muz5yvUEI5CaGr2hj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e4cd8e9d3f58fb075f157a516ee1f058f0d44305b3689ff3b390aa0a40bfaa7d

Files

e4cd8e9d3f58fb075f157a516ee1f058f0d44305b3689ff3b390aa0a40bfaa7d
.exe windows:6 windows x86 arch:x86

171f6ec659a3005b91695ec7693d3095

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
GetCurrentProcess
GlobalFlags
GetSystemInfo
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleHandleW
IsBadReadPtr
VirtualQuery
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
CreateEventW
SetEvent
ResetEvent
GetSystemTimeAsFileTime
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
LocalFileTimeToFileTime
SystemTimeToFileTime
UnmapViewOfFile
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
FindResourceW
LoadResource
LockResource
FreeResource
GetCurrentThreadId
SizeofResource
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
LocalFree
FormatMessageW
GetLastError
WideCharToMultiByte
IsDebuggerPresent
DeleteCriticalSection
InitializeCriticalSection
WriteFile
SetFilePointer
GetModuleFileNameW
ExpandEnvironmentStringsW
GetTickCount
LeaveCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
ReadFile
GetProcAddress
LoadLibraryW
SetWaitableTimer
CreateWaitableTimerW
CloseHandle
TerminateProcess
OpenProcess
GetCurrentProcessId

user32

wsprintfW
MonitorFromWindow
GetWindowLongW
GetClassNameW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
SendMessageW
LoadStringW
EnumWindows
LoadIconW
LoadCursorW
GetDesktopWindow
GetParent
LoadImageW
GetDC
ReleaseDC
GetMessageW
MessageBoxW

gdi32

DeleteDC
GetDeviceCaps
CreateCompatibleDC
SetDIBColorTable
CreateDIBSection
SelectObject
GetObjectW
DeleteObject

advapi32

CryptAcquireContextA
RegCloseKey
RegOpenKeyExW
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
RegQueryValueExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy

winhttp

WinHttpOpenRequest
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpOpen
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpSetStatusCallback
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpReadData
WinHttpSetTimeouts
WinHttpAddRequestHeaders

ws2_32

WSACleanup

msvcp140

?_Xlength_error@std@@YAXPBD@Z

gdiplus

GdipCreateBitmapFromFile
GdipGetImageWidth
GdipSetCompositingMode
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdiplusShutdown
GdipBitmapLockBits
GdipFree
GdipGetImagePixelFormat
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImageHeight
GdiplusStartup

vcruntime140

memcpy
_CxxThrowException
_except_handler4_common
memset
__current_exception_context
__current_exception
_purecall
wcsstr
wcsrchr
wcschr
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
memmove

api-ms-win-crt-string-l1-1-0

_stricmp
strncmp
isprint
_wcsnicmp
wcsncmp
iswprint

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_get_wide_winmain_command_line
_initialize_wide_environment
_seh_filter_exe
exit
__p___wargv
__p___argc
_cexit
terminate
_crt_atexit
_controlfp_s
_invalid_parameter_noinfo
_errno
_register_thread_local_exe_atexit_callback
_set_app_type
_register_onexit_function
_initialize_onexit_table
_c_exit
_initterm
_configure_wide_argv
_initterm_e
_exit

api-ms-win-crt-heap-l1-1-0

malloc
free
realloc
calloc
_callnewh
_set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi
_wtoi

api-ms-win-crt-time-l1-1-0

_localtime64
wcsftime

api-ms-win-crt-math-l1-1-0

ceil
floor
__setusermatherr

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

api-ms-win-crt-stdio-l1-1-0

fread
ftell
fseek
ferror
_wfopen
__p__commode
__stdio_common_vswprintf
_set_fmode
fclose

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

?get_active_implementation@simdutf@@YAAAV?$atomic_ptr@$$CBVimplementation@simdutf@@@internal@1@XZ
?get_available_implementations@simdutf@@YAABVavailable_implementation_list@internal@1@XZ

Sections

.text
Size: 255KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1934950
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

171f6ec659a3005b91695ec7693d3095

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

winhttp

ws2_32

msvcp140

gdiplus

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 255KB - Virtual size: 255KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 3KB - Virtual size: 5KB

.1934950 Size: 14KB - Virtual size: 14KB

.rsrc Size: 169KB - Virtual size: 168KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 255KB - Virtual size: 255KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 3KB - Virtual size: 5KB

.1934950
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 169KB - Virtual size: 168KB

.reloc
Size: 20KB - Virtual size: 20KB