f90f456c15b840ba05988cfd15bc9cab873623557f788a941448ecaee09ee0bd

Sharing

Copy URL Twitter E-mail

General

Target

f90f456c15b840ba05988cfd15bc9cab873623557f788a941448ecaee09ee0bd
Size

1.4MB
MD5

baed14eb22589e7ced91e7bdbc543792
SHA1

68af340e0ace1b4802a852cef1797db28f4033e9
SHA256

f90f456c15b840ba05988cfd15bc9cab873623557f788a941448ecaee09ee0bd
SHA512

ecefd79256db3ca53b2ba8897c39878d53948fba53c96a5476a398cb4f16c6361cacc2a89bcf21531550539826d9c2856df8f72702ad4748149b97298753e867
SSDEEP

24576:cwNyeQGkWEADReF2VW3aVj+9F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NeWEADReF2VW3aVj+9FLNiXicJFFRGNf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f90f456c15b840ba05988cfd15bc9cab873623557f788a941448ecaee09ee0bd

Files

f90f456c15b840ba05988cfd15bc9cab873623557f788a941448ecaee09ee0bd
.exe windows:6 windows x86 arch:x86

097ad06e246f9056e5793c4dd9e6011b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SynchronizerApp.pdb

Imports

shlwapi

UrlCanonicalizeA
PathRemoveFileSpecW
StrCmpNA

kernel32

GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
VerSetConditionMask
GetProcessHeap
HeapSetInformation
VerifyVersionInfoW
RaiseException
DecodePointer
OutputDebugStringA
lstrlenW
GetTickCount
Sleep
GetCurrentProcess
GetCurrentThread
OpenMutexW
SetNamedPipeHandleState
OutputDebugStringW
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
GetUserDefaultLCID
LoadLibraryExW
GetCurrentProcessId
CreateNamedPipeA
GetOverlappedResult
PeekNamedPipe
DisconnectNamedPipe
ConnectNamedPipe
GetLastError
FindNextChangeNotification
FindFirstChangeNotificationW
WaitForMultipleObjects
CreateEventA
DeleteCriticalSection
FindCloseChangeNotification
LoadLibraryA
lstrlenA
GetSystemDirectoryA
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
RemoveDirectoryW
FindNextFileW
CreateDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
CreateSemaphoreA
LocalFree
LocalAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
MoveFileW
SetFilePointer
SetEndOfFile
GetFullPathNameW
GetFileInformationByHandle
GetDriveTypeW
FlushFileBuffers
FindFirstFileW
FindClose
DeleteFileW
CreateThread
SwitchToThread
WaitForSingleObject
ReleaseSemaphore
LoadLibraryExA
FreeLibrary
InitializeCriticalSectionEx
SetEvent
SetLastError
CloseHandle
WriteFile
ReadFile
GetVolumeInformationW
CreateFileW
ResetEvent

user32

SetPropW
GetPropW
SetForegroundWindow
InsertMenuItemW
TrackPopupMenu
InsertMenuW
GetCursorPos
CreatePopupMenu
GetSystemMetrics
DestroyWindow
CreateWindowExW
RegisterClassW
CallWindowProcA
PostQuitMessage
DefWindowProcA
PostMessageA
DestroyMenu
PostMessageW
FindWindowW
LoadStringW
GetMessageA
TranslateMessage
LoadImageW
DispatchMessageA

sensapi

IsNetworkAlive

msvcp120

?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?uncaught_exception@std@@YA_NXZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?_Xlength_error@std@@YAXPBD@Z

msvcr120

_mbschr
toupper
_strlwr
strcpy_s
sscanf
sprintf
sprintf_s
malloc
wcscpy_s
swscanf_s
_vsnwprintf_s
iswalpha
memcmp
memchr
_wcslwr_s
wcslen
_set_invalid_parameter_handler
_get_heap_handle
memcpy
memmove
free
_wcsicmp
_purecall
isdigit
strchr
__RTDynamicCast
__CxxFrameHandler3
_CxxThrowException
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@XZ
strlen
strcmp
memcpy_s
??3@YAXPAX@Z
??_V@YAXPAX@Z
memset
isxdigit
_mktime64
realloc
_wcsnicmp
_lock
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
?terminate@@YAXXZ
_except1
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_acmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
_except_handler4_common
??1type_info@@UAE@XZ
isspace
__dllonexit
wcstok_s
wcsrchr
atoi
pow
_calloc_crt
_unlock
wcsnlen
??2@YAPAXI@Z
iswdigit
_onexit

ws2_32

WSAIoctl
WSAEventSelect
WSACreateEvent
WSAGetLastError
WSACleanup
WSAStartup
WSASocketA

crypt32

CryptProtectData
CryptUnprotectData

advapi32

RegCloseKey
ConvertSidToStringSidA
GetTokenInformation
RegOpenKeyW
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
OpenThreadToken
OpenProcessToken
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetSpecialFolderLocation
ShellExecuteA
Shell_NotifyIconW
SHFileOperationA
SHGetPathFromIDListW

ole32

CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData

netapi32

NetShareGetInfo

wininet

InternetCrackUrlA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
HttpEndRequestA
HttpSendRequestExA
InternetSetOptionA
InternetWriteFile
InternetReadFile
HttpAddRequestHeadersA
InternetCloseHandle

mpr

WNetGetResourceInformationW
WNetAddConnection2W
WNetCancelConnection2W

Sections

.text
Size: 614KB - Virtual size: 614KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 608KB - Virtual size: 612KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

097ad06e246f9056e5793c4dd9e6011b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

sensapi

msvcp120

msvcr120

ws2_32

crypt32

advapi32

shell32

ole32

oleaut32

netapi32

wininet

mpr

Sections

.text Size: 614KB - Virtual size: 614KB

.rdata Size: 161KB - Virtual size: 160KB

.data Size: 25KB - Virtual size: 31KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 608KB - Virtual size: 612KB

.text
Size: 614KB - Virtual size: 614KB

.rdata
Size: 161KB - Virtual size: 160KB

.data
Size: 25KB - Virtual size: 31KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 608KB - Virtual size: 612KB