0000000001224555887485412221554520000000000151548542454651625[.]tar

Sharing

Copy URL Twitter E-mail

General

Target

0000000001224555887485412221554520000000000151548542454651625.tar
Size

992KB
MD5

e9a93d6ae076ab18e8198b393d916376
SHA1

22255a7905d7c48fc1a63b0e5e1b796957189591
SHA256

7cae041a3661cf3a54e7930124dda510049432c958a309f2e51ed34e35f14117
SHA512

123747976548b256929a1dcefa931797db7a2796355ecc6cbd3fd114c848ae07c7b6a73062076ae86c8bf538d7946dd113c15e46611b177666e428b7837eb0c1
SSDEEP

24576:1SqJvY/v14kaAgR41Co+bbd/fZ3zPjYb28CktppTy4:jQ/v14kaAJ1Chx/fZDP0bSkt7Ty4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0000000001224555887485412221554520000000000151548542454651625.exe

Files

0000000001224555887485412221554520000000000151548542454651625.tar
.rar

Password: 1220
0000000001224555887485412221554520000000000151548542454651625.exe
.exe windows:6 windows x86 arch:x86

Password: 1220

a8c03275b237f658afabd8e2e2d703e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\sdk\vs2015-x86\crashrpt2-master\build\bin\CrashSender1500.pdb

Imports

ws2_32

ntohs
inet_ntoa
inet_addr
htons
htonl
connect
closesocket
recv
getservbyname
WSAStartup
WSACleanup
WSASetLastError
WSAGetLastError
gethostbyname
gethostbyaddr
getservbyport
socket
send

dnsapi

DnsQuery_W
DnsFree

wininet

InternetWriteFile
InternetSetOptionW
HttpOpenRequestW
InternetReadFile
HttpEndRequestW
HttpQueryInfoW
InternetOpenW
InternetCloseHandle
HttpSendRequestExW
InternetConnectW
InternetQueryOptionW

rpcrt4

UuidToStringA
RpcStringFreeA

gdi32

SetViewportOrgEx
CreateDCW
SetLayout
GetDIBits
SetBkColor
TextOutW
CreateHalftonePalette
GetDIBColorTable
CreateDIBSection
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
SetStretchBltMode
SelectObject
SetBkMode
SetTextColor
GetObjectW
Polygon
CreateSolidBrush
GetStockObject
SetDCBrushColor
BitBlt
CreateFontW
CreatePalette
CreateRectRgn
RealizePalette
SelectClipRgn
SelectPalette
SetDIBits
StretchBlt

shell32

ShellExecuteW
SHGetFileInfoW
CommandLineToArgvW
Shell_NotifyIconW
SHGetSpecialFolderPathW
ExtractIconW
SHFileOperationW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetProcessMemoryInfo

kernel32

WaitForSingleObjectEx
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
OpenFileMappingW
SystemTimeToFileTime
WritePrivateProfileStringW
GetPrivateProfileStringW
FormatMessageW
GlobalFree
EncodePointer
HeapAlloc
HeapFree
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetProcessHeap
GetTempPathW
GetTempFileNameW
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
lstrlenW
WideCharToMultiByte
CreateFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileSizeEx
GetFullPathNameW
DebugBreak
OutputDebugStringW
CloseHandle
SetLastError
GetProcessTimes
OpenProcess
GetSystemTime
ReadProcessMemory
FreeLibrary
GetProcAddress
LoadLibraryW
lstrlenA
CopyFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MultiByteToWideChar
VerSetConditionMask
GetCommandLineW
DecodePointer
RaiseException
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
MulDiv
lstrcmpW
lstrcmpiW
VerifyVersionInfoW
CompareStringW
GetFileInformationByHandle
ReadFile
WriteFile
CreateMutexW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateThread
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
InitializeCriticalSection
Sleep
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalLock
GlobalUnlock
GetSystemDirectoryA
LoadLibraryA
GetTimeZoneInformation
CreateDirectoryW
GetFileAttributesExW
GetSystemTimeAsFileTime

user32

CreateDialogParamW
GetDlgItem
GetDlgCtrlID
SetFocus
GetFocus
GetKeyState
GetCapture
SetCapture
ReleaseCapture
IsWindowEnabled
DrawTextW
UpdateWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
RedrawWindow
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
SetCursor
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
GetSysColorBrush
DrawFocusRect
FillRect
SetRectEmpty
OffsetRect
PtInRect
GetWindowLongW
SetWindowLongW
GetDesktopWindow
GetParent
GetClassNameW
LoadCursorW
DestroyIcon
LoadImageW
DispatchMessageW
EndDialog
GetActiveWindow
LoadMenuW
DestroyMenu
EnableMenuItem
IsWindowVisible
DeleteMenu
TrackPopupMenu
SetMenuItemInfoW
SetWindowTextW
GetWindow
CheckMenuRadioItem
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
PostQuitMessage
FlashWindow
MoveWindow
DialogBoxParamW
EnableWindow
GetMenu
DrawIcon
DrawTextExW
AdjustWindowRectEx
MessageBoxW
CopyRect
LoadIconW
GetIconInfo
IsDialogMessageW
PostMessageW
SetProcessDefaultLayout
CharUpperW
SetTimer
KillTimer
DrawTextExA
SetScrollInfo
GetScrollInfo
AnimateWindow
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
IntersectRect
EnumWindows
GetWindowThreadProcessId
EnumDisplayMonitors
GetCursorInfo
SetWindowPos
ShowWindow
DestroyWindow
IsWindow
TranslateMessage
GetMessageW
GetGuiResources
CharNextW
LoadStringW
CreateWindowExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
SendMessageW
GetSubMenu
PeekMessageW
SystemParametersInfoW

ole32

CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoCreateGuid

oleaut32

VarDecFromStr
VarUI4FromStr
VarDecCmp
VarR8FromStr
VarI4FromStr
SysFreeString
VarDateFromStr

advapi32

RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
RegEnumValueW
RegSetValueExW
OpenProcessToken
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Remove
_TrackMouseEvent

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

vcruntime140

__std_type_info_destroy_list
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
longjmp
__std_exception_destroy
__std_exception_copy
strchr
__CxxLongjmpUnwind
_setjmp3
wcsstr
_purecall
wcsrchr
wcschr
__std_terminate
memset
memcpy
__CxxFrameHandler3
memchr
_CxxThrowException
memmove

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_initialize_onexit_table
_cexit
_controlfp_s
_initialize_narrow_environment
_configure_narrow_argv
_execute_onexit_table
terminate
_crt_at_quick_exit
_configure_wide_argv
_initterm
_initterm_e
exit
_errno
_exit
_c_exit
_initialize_wide_environment
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo
abort
_crt_atexit
_seh_filter_dll
_register_onexit_function
_get_wide_winmain_command_line

api-ms-win-crt-stdio-l1-1-0

fputc
__stdio_common_vsnprintf_s
tmpfile
__stdio_common_vsscanf
fflush
_set_fmode
__stdio_common_vsprintf
__acrt_iob_func
_ftelli64
ftell
_fseeki64
fseek
fopen
ferror
_wfopen
__p__commode
__stdio_common_vswprintf_s
__stdio_common_vfprintf
rewind
fclose
_wfopen_s
__stdio_common_vsprintf_s
fwrite
fread
feof
__stdio_common_vfwprintf
fopen_s

api-ms-win-crt-string-l1-1-0

iswspace
toupper
strncmp
tolower
isspace
isalpha
_wcsicmp
strncpy
wcstok_s
wcspbrk
wcscspn
wcsncmp
wcscpy_s
strncpy_s
isalnum
strcat_s
iswdigit
strcpy_s
isdigit
wcsncpy_s

api-ms-win-crt-convert-l1-1-0

strtod
_wtol
_wtoi
atof
strtoul
atoi

api-ms-win-crt-heap-l1-1-0

_recalloc
realloc
_set_new_mode
malloc
free
_callnewh
calloc

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s
wcsftime
_gmtime64_s
_gmtime64
strftime

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-math-l1-1-0

ceil
_libm_sse2_pow_precise
_except1
__setusermatherr

api-ms-win-crt-environment-l1-1-0

getenv
_wdupenv_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 800KB - Virtual size: 799KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1220

Password: 1220

a8c03275b237f658afabd8e2e2d703e1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

dnsapi

wininet

rpcrt4

gdi32

shell32

comdlg32

version

psapi

kernel32

user32

ole32

oleaut32

advapi32

comctl32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 800KB - Virtual size: 799KB

.rdata Size: 181KB - Virtual size: 181KB

.data Size: 4KB - Virtual size: 5KB

.gfids Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 800KB - Virtual size: 799KB

.rdata
Size: 181KB - Virtual size: 181KB

.data
Size: 4KB - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 27KB - Virtual size: 27KB