0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900.exe
Size

3.1MB
MD5

ef9ca8c2e7af86d9c440d78027bbc2ae
SHA1

3bc2144e3cc300542eab8c4b98691027611919c0
SHA256

0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900
SHA512

6580bf439b4eabc12a7d19ec71713cd4a7d60558a92cd28dbe8d952ed9c21da691c334cb026dd37ef3628ec67f56d2406541c760a7d9d84012123c2298adee7d
SSDEEP

98304:UObppUKlSjRvw+QlFZA6eyElAijr7K93GqyKPxkDNZ:SJFv8zZA6ferO9dyqSN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900.exe

Files

0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900.exe
.exe windows:5 windows x86 arch:x86

e3a7c5d6054e45d92305be46e5850ca7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\webapps\b\build\slave\repo\build\src\out\Release\Uninstall.exe.pdb

Imports

gdiplus

GdipCreateImageAttributes
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipFillRectangle
GdipFillPath
GdipDrawImageRectI
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromResource
GdipGetImageWidth
GdipAlloc
GdipFillEllipse
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetSolidFillColor
GdipCreateBitmapFromStream
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipFree
GdipSetSolidFillColor
GdipSetClipRegion
GdipDeleteRegion
GdipCreateRegionPath
GdipAddPathArc
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipDrawString
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipFillRectangleI
GdipDrawRectangle
GdipDeletePen
GdipCreatePen1
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericDefault
GdipMeasureString
GdipDeleteFont
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipReleaseDC
GdipGetDC
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipDrawImageRectRectI
GdipDrawImageRect
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes

advapi32

AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
SystemFunction036
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
CreateProcessAsUserW
LookupPrivilegeValueW

gdi32

GetObjectA
DeleteObject
CreateBitmap
CreateCompatibleDC
DeleteDC
SelectObject
BitBlt
CreateDIBSection
CreateFontW
CreateCompatibleBitmap
CreateFontIndirectW
CreatePatternBrush
CreateRoundRectRgn
GetStockObject
PatBlt
SetBkColor
SetBkMode
SetTextColor
GetObjectW
ExtTextOutW
SetViewportOrgEx
SetWindowOrgEx
CreateRectRgn
PtInRegion

kernel32

IsProcessorFeaturePresent
InitializeCriticalSection
FormatMessageW
SetErrorMode
RtlCaptureContext
CreateFileA
UnhandledExceptionFilter
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetDriveTypeW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
GetStartupInfoW
InitializeSListHead
EncodePointer
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
LoadLibraryExA
RtlUnwind
GetConsoleCP
GetConsoleMode
GetFullPathNameW
SetStdHandle
ExitThread
FreeLibraryAndExitThread
GetACP
CreateMutexW
ReadConsoleW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
WriteConsoleW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SleepEx
GetFileType
PeekNamedPipe
GetSystemDirectoryW
GetWindowsDirectoryW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
lstrcmpiW
ExpandEnvironmentStringsW
CreateFileW
LocalFileTimeToFileTime
ReadFile
SetFileAttributesW
SetFilePointer
SetFileTime
WriteFile
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
LoadLibraryExW
DosDateTimeToFileTime
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetVolumeInformationW
GetVolumePathNameW
RemoveDirectoryW
GetTempPathW
GetLastError
WaitForSingleObject
GetCurrentProcess
ExitProcess
GetExitCodeProcess
CreateProcessW
GetModuleFileNameW
GetModuleHandleW
LocalAlloc
SetProcessWorkingSetSize
EnumResourceNamesW
DecodePointer
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCommandLineW
SetLastError
EnterCriticalSection
LeaveCriticalSection
Sleep
GetCurrentProcessId
GetCurrentThreadId
ProcessIdToSessionId
FreeLibrary
SetDllDirectoryW
GetTickCount
CreateEventW
FindResourceExW
FreeResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CompareStringW
GetDiskFreeSpaceExW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleExW
LoadLibraryW
GetCurrentDirectoryW
OutputDebugStringA
FormatMessageA
SetCurrentDirectoryW
GetFileAttributesExW
GetLongPathNameW
GetTempFileNameW
CopyFileW
MoveFileExW
GetProcessId
DuplicateHandle
TerminateProcess
GetStdHandle
SetHandleInformation
ResumeThread
AssignProcessToJobObject
GetVersionExW
GetNativeSystemInfo
SetEvent
ResetEvent
WaitForMultipleObjects
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
SetThreadPriority
GetThreadPriority
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FlushFileBuffers
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
IsDebuggerPresent
CreateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
TryEnterCriticalSection
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
VirtualAlloc
VirtualFree
GetEnvironmentVariableW
SetEnvironmentVariableW

msimg32

AlphaBlend

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr
SysAllocString
VariantInit
SysFreeString
VariantClear

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

shell32

ShellExecuteW
ord680
CommandLineToArgvW
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFolderPathW

user32

UpdateWindow
DrawTextW
GetMenu
GetSystemMetrics
IsWindowEnabled
EnableWindow
GetCapture
SetFocus
GetWindowTextLengthW
SetWindowRgn
GetWindowRgn
EnumChildWindows
LoadStringW
IsDialogMessageW
LoadImageW
DestroyCursor
GetClassNameW
GetWindowTextW
RedrawWindow
SetWindowTextW
OffsetRect
CopyRect
SetRectEmpty
FillRect
GetSysColor
ClientToScreen
GetCursorPos
AdjustWindowRectEx
InvalidateRect
UnregisterClassW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
DestroyWindow
ShowWindow
SetWindowPos
CreateDialogParamW
CharNextW
GetClientRect
GetWindowRect
MessageBoxW
MapWindowPoints
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
TrackMouseEvent
IsWindow
UpdateLayeredWindow
MoveWindow
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
SetCursor
ScreenToClient
LoadCursorW
PostMessageW
RegisterClassExW
CreateWindowExW
BeginPaint
EndPaint
PtInRect
PostQuitMessage
SetForegroundWindow
SendMessageW
CallWindowProcW
GetClassInfoExW
IsWindowVisible
GetDlgItem
GetDlgCtrlID

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

ws2_32

accept
sendto
recvfrom
__WSAFDIsSet
freeaddrinfo
getaddrinfo
WSASetLastError
setsockopt
ntohs
htons
getsockopt
listen
getpeername
connect
bind
send
recv
WSAGetLastError
socket
closesocket
WSACleanup
WSAStartup
select
gethostname
getsockname
ioctlsocket

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

comctl32

_TrackMouseEvent

winhttp

WinHttpGetIEProxyConfigForCurrentUser

Exports

Exports

GetHandleVerifier
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 902KB - Virtual size: 902KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3a7c5d6054e45d92305be46e5850ca7

Headers

File Characteristics

PDB Paths

Imports

gdiplus

advapi32

gdi32

kernel32

msimg32

ole32

oleaut32

psapi

shell32

user32

wininet

winmm

ws2_32

userenv

comctl32

winhttp

Exports

Exports

Sections

.text Size: 902KB - Virtual size: 902KB

.data Size: 6KB - Virtual size: 26KB

.idata Size: 11KB - Virtual size: 11KB

.gfids Size: 1024B - Virtual size: 832B

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 902KB - Virtual size: 902KB

.data
Size: 6KB - Virtual size: 26KB

.idata
Size: 11KB - Virtual size: 11KB

.gfids
Size: 1024B - Virtual size: 832B

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 29KB - Virtual size: 28KB