e0ee439507a04bf643b1a09fba0d4690N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

e0ee439507a04bf643b1a09fba0d4690N.exe
Size

533KB
MD5

e0ee439507a04bf643b1a09fba0d4690
SHA1

a46a4d1ee6fb1dde455b5724d89e14db0d1ccca4
SHA256

54b89294873c7c3d5c44314e451cded0ba5a11d89802fc7feec9e7641551bd9f
SHA512

8eb6dd7db08e7c6586067b6b9448e0ef601f3b280e5d02019f065367511fac68e1a387e43ab2c4f7d20ceb36c383094e3df679cdba370598306d82bfeb16f167
SSDEEP

12288:yDeWfFQkq3Oay3bsYGgKGK7f3XNaryf+YLCZg8+InLES6QMi+YNzzV+/:geUFQR1YGc6XNnL0g8DnwXQMi+YNzz0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0ee439507a04bf643b1a09fba0d4690N.exe

Files

e0ee439507a04bf643b1a09fba0d4690N.exe
.exe windows:5 windows x86 arch:x86

8bf9e76c78db414baee0cf7b645cd77a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
SetLastError
FlushInstructionCache
GetCurrentProcess
WaitForMultipleObjects
LoadLibraryW
QueryDosDeviceW
GetLogicalDriveStringsW
CreateEventW
WaitForSingleObject
GetExitCodeProcess
OpenProcess
GetWindowsDirectoryW
GetVolumeInformationW
GetEnvironmentVariableW
GetVersionExW
GetCurrentThreadId
InterlockedIncrement
SetEvent
ResetEvent
SetThreadPriority
ResumeThread
ExitThread
ReadFile
SetFilePointer
GetFileSize
GetProcessId
CreateFileW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
LoadLibraryExW
MultiByteToWideChar
GetLastError
EnterCriticalSection
RaiseException
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
LeaveCriticalSection
lstrcmpiW
GetStringTypeW
GetStringTypeA
LCMapStringW
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LCMapStringA
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
HeapCreate
ExitProcess
Sleep
GetLocalTime
GetTimeZoneInformation
CreateMutexW
OpenMutexW
CloseHandle
GetCommandLineW
LocalFree
DeleteFileW
FormatMessageW
SystemTimeToFileTime
FileTimeToSystemTime
GetFileAttributesExW
CopyFileW
WriteFile
FlushFileBuffers
CreateDirectoryW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
lstrcmpW
GetTickCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
CreateThread

user32

SetMenuItemInfoW
GetMenuItemInfoW
IsMenu
DialogBoxParamW
GetSystemMetrics
LoadImageW
DestroyIcon
LoadCursorW
SetCursor
RegisterClassExW
GetClassInfoExW
CreateWindowExW
CallWindowProcW
PostMessageW
DestroyAcceleratorTable
GetDesktopWindow
ReleaseDC
GetDC
InvalidateRect
InvalidateRgn
GetParent
ScreenToClient
ClientToScreen
RedrawWindow
GetSysColor
GetClassNameW
GetDlgItem
IsChild
EndPaint
BeginPaint
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
UnregisterClassA
GetActiveWindow
GetFocus
SetFocus
SetForegroundWindow
IsWindow
TrackPopupMenuEx
GetCursorPos
GetSubMenu
LoadMenuW
ShowWindow
SetCapture
PtInRect
IsRectEmpty
MoveWindow
GetMonitorInfoW
ReleaseCapture
OffsetRect
MonitorFromWindow
GetWindow
SetWindowTextW
CreateAcceleratorTableW
MapWindowPoints
GetWindowRect
SetWindowLongW
GetWindowLongW
SendMessageW
SetWindowPos
GetClientRect
SetRectEmpty
EndDialog
LoadStringW
MessageBoxW
DestroyWindow
DefWindowProcW
CharNextW
FillRect

advapi32

AllocateAndInitializeSid
RegDeleteKeyExW
RegQueryValueExW
FreeSid
CheckTokenMembership
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegEnumValueW

ole32

CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleInitialize
CLSIDFromString
CoGetClassObject
OleLockRunning
CLSIDFromProgID
CoInitialize
CoUninitialize
CoSetProxyBlanket
CreateStreamOnHGlobal
OleUninitialize
StringFromGUID2
StringFromCLSID

oleaut32

VariantInit
VariantCopy
GetErrorInfo
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SafeArrayGetUBound
SafeArrayCreateVector
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
DispCallFunc
VariantChangeType
VarUI4FromStr
SysFreeString
VariantClear
SysAllocString

shlwapi

PathFileExistsW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CertNameToStrW
CryptQueryObject
CryptMsgGetParam
CertGetNameStringW
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose

urlmon

CoInternetParseUrl

wininet

HttpOpenRequestW
InternetConnectW
InternetCloseHandle
HttpSendRequestW
InternetOpenW
InternetQueryOptionW
HttpQueryInfoW
InternetOpenUrlW
InternetReadFile
InternetSetOptionW

gdi32

GetDeviceCaps
GetStockObject
DeleteDC
BitBlt
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
GetObjectW

shell32

ShellExecuteW
ord190
ShellExecuteExW
Shell_NotifyIconW
SHOpenFolderAndSelectItems
ord155
CommandLineToArgvW

psapi

GetProcessImageFileNameW

Exports

Exports

arcfour_LTX__is_block_algorithm
arcfour_LTX__mcrypt_algorithm_version
arcfour_LTX__mcrypt_decrypt
arcfour_LTX__mcrypt_encrypt
arcfour_LTX__mcrypt_get_algo_iv_size
arcfour_LTX__mcrypt_get_algorithms_name
arcfour_LTX__mcrypt_get_block_size
arcfour_LTX__mcrypt_get_key_size
arcfour_LTX__mcrypt_get_size
arcfour_LTX__mcrypt_get_supported_key_sizes
arcfour_LTX__mcrypt_self_test
arcfour_LTX__mcrypt_set_key
blowfish_LTX__is_block_algorithm
blowfish_LTX__mcrypt_algorithm_version
blowfish_LTX__mcrypt_decrypt
blowfish_LTX__mcrypt_encrypt
blowfish_LTX__mcrypt_get_algorithms_name
blowfish_LTX__mcrypt_get_block_size
blowfish_LTX__mcrypt_get_key_size
blowfish_LTX__mcrypt_get_size
blowfish_LTX__mcrypt_get_supported_key_sizes
blowfish_LTX__mcrypt_self_test
blowfish_LTX__mcrypt_set_key
blowfish_compat_LTX__is_block_algorithm
blowfish_compat_LTX__mcrypt_algorithm_version
blowfish_compat_LTX__mcrypt_decrypt
blowfish_compat_LTX__mcrypt_encrypt
blowfish_compat_LTX__mcrypt_get_algorithms_name
blowfish_compat_LTX__mcrypt_get_block_size
blowfish_compat_LTX__mcrypt_get_key_size
blowfish_compat_LTX__mcrypt_get_size
blowfish_compat_LTX__mcrypt_get_supported_key_sizes
blowfish_compat_LTX__mcrypt_self_test
blowfish_compat_LTX__mcrypt_set_key
cast_128_LTX__is_block_algorithm
cast_128_LTX__mcrypt_algorithm_version
cast_128_LTX__mcrypt_decrypt
cast_128_LTX__mcrypt_encrypt
cast_128_LTX__mcrypt_get_algorithms_name
cast_128_LTX__mcrypt_get_block_size
cast_128_LTX__mcrypt_get_key_size
cast_128_LTX__mcrypt_get_size
cast_128_LTX__mcrypt_get_supported_key_sizes
cast_128_LTX__mcrypt_self_test
cast_128_LTX__mcrypt_set_key
cast_256_LTX__is_block_algorithm
cast_256_LTX__mcrypt_algorithm_version
cast_256_LTX__mcrypt_decrypt
cast_256_LTX__mcrypt_encrypt
cast_256_LTX__mcrypt_get_algorithms_name
cast_256_LTX__mcrypt_get_block_size
cast_256_LTX__mcrypt_get_key_size
cast_256_LTX__mcrypt_get_size
cast_256_LTX__mcrypt_get_supported_key_sizes
cast_256_LTX__mcrypt_self_test
cast_256_LTX__mcrypt_set_key
des_LTX__is_block_algorithm
des_LTX__mcrypt_algorithm_version
des_LTX__mcrypt_decrypt
des_LTX__mcrypt_encrypt
des_LTX__mcrypt_get_algorithms_name
des_LTX__mcrypt_get_block_size
des_LTX__mcrypt_get_key_size
des_LTX__mcrypt_get_size
des_LTX__mcrypt_get_supported_key_sizes
des_LTX__mcrypt_self_test
des_LTX__mcrypt_set_key
end_mcrypt
enigma_LTX__is_block_algorithm
enigma_LTX__mcrypt_algorithm_version
enigma_LTX__mcrypt_decrypt
enigma_LTX__mcrypt_encrypt
enigma_LTX__mcrypt_get_algo_iv_size
enigma_LTX__mcrypt_get_algorithms_name
enigma_LTX__mcrypt_get_block_size
enigma_LTX__mcrypt_get_key_size
enigma_LTX__mcrypt_get_size
enigma_LTX__mcrypt_get_supported_key_sizes
enigma_LTX__mcrypt_self_test
enigma_LTX__mcrypt_set_key
gost_LTX__is_block_algorithm
gost_LTX__mcrypt_algorithm_version
gost_LTX__mcrypt_decrypt
gost_LTX__mcrypt_encrypt
gost_LTX__mcrypt_get_algorithms_name
gost_LTX__mcrypt_get_block_size
gost_LTX__mcrypt_get_key_size
gost_LTX__mcrypt_get_size
gost_LTX__mcrypt_get_supported_key_sizes
gost_LTX__mcrypt_self_test
gost_LTX__mcrypt_set_key
init_mcrypt
loki97_LTX__is_block_algorithm
loki97_LTX__mcrypt_algorithm_version
loki97_LTX__mcrypt_decrypt
loki97_LTX__mcrypt_encrypt
loki97_LTX__mcrypt_get_algorithms_name
loki97_LTX__mcrypt_get_block_size
loki97_LTX__mcrypt_get_key_size
loki97_LTX__mcrypt_get_size
loki97_LTX__mcrypt_get_supported_key_sizes
loki97_LTX__mcrypt_self_test
loki97_LTX__mcrypt_set_key
mcrypt
mcrypt_dlopen
mcrypt_enc_get_algorithms_name
mcrypt_enc_get_block_size
mcrypt_enc_get_iv_size
mcrypt_enc_get_key_size
mcrypt_enc_get_modes_name
mcrypt_enc_get_state
mcrypt_enc_get_supported_key_sizes
mcrypt_enc_is_block_algorithm
mcrypt_enc_is_block_algorithm_mode
mcrypt_enc_is_block_mode
mcrypt_enc_mode_has_iv
mcrypt_enc_self_test
mcrypt_enc_set_state
mcrypt_free
mcrypt_generic
mcrypt_generic_deinit
mcrypt_generic_end
mcrypt_generic_init
mcrypt_get_algo_iv_size
mcrypt_get_size
mcrypt_mode_get_size
mcrypt_module_algorithm_version
mcrypt_module_close
mcrypt_module_get_algo_block_size
mcrypt_module_get_algo_key_size
mcrypt_module_get_algo_supported_key_sizes
mcrypt_module_is_block_algorithm
mcrypt_module_is_block_algorithm_mode
mcrypt_module_is_block_mode
mcrypt_module_mode_version
mcrypt_module_open
mcrypt_module_self_test
mcrypt_perror
mcrypt_set_key
mcrypt_strerror
mdecrypt
mdecrypt_generic
rc2_LTX__is_block_algorithm
rc2_LTX__mcrypt_algorithm_version
rc2_LTX__mcrypt_decrypt
rc2_LTX__mcrypt_encrypt
rc2_LTX__mcrypt_get_algorithms_name
rc2_LTX__mcrypt_get_block_size
rc2_LTX__mcrypt_get_key_size
rc2_LTX__mcrypt_get_size
rc2_LTX__mcrypt_get_supported_key_sizes
rc2_LTX__mcrypt_self_test
rc2_LTX__mcrypt_set_key
rijndael_128_LTX__is_block_algorithm
rijndael_128_LTX__mcrypt_algorithm_version
rijndael_128_LTX__mcrypt_decrypt
rijndael_128_LTX__mcrypt_encrypt
rijndael_128_LTX__mcrypt_get_algorithms_name
rijndael_128_LTX__mcrypt_get_block_size
rijndael_128_LTX__mcrypt_get_key_size
rijndael_128_LTX__mcrypt_get_size
rijndael_128_LTX__mcrypt_get_supported_key_sizes
rijndael_128_LTX__mcrypt_self_test
rijndael_128_LTX__mcrypt_set_key
rijndael_192_LTX__is_block_algorithm
rijndael_192_LTX__mcrypt_algorithm_version
rijndael_192_LTX__mcrypt_decrypt
rijndael_192_LTX__mcrypt_encrypt
rijndael_192_LTX__mcrypt_get_algorithms_name
rijndael_192_LTX__mcrypt_get_block_size
rijndael_192_LTX__mcrypt_get_key_size
rijndael_192_LTX__mcrypt_get_size
rijndael_192_LTX__mcrypt_get_supported_key_sizes
rijndael_192_LTX__mcrypt_self_test
rijndael_192_LTX__mcrypt_set_key
rijndael_256_LTX__is_block_algorithm
rijndael_256_LTX__mcrypt_algorithm_version
rijndael_256_LTX__mcrypt_decrypt
rijndael_256_LTX__mcrypt_encrypt
rijndael_256_LTX__mcrypt_get_algorithms_name
rijndael_256_LTX__mcrypt_get_block_size
rijndael_256_LTX__mcrypt_get_key_size
rijndael_256_LTX__mcrypt_get_size
rijndael_256_LTX__mcrypt_get_supported_key_sizes
rijndael_256_LTX__mcrypt_self_test
rijndael_256_LTX__mcrypt_set_key
saferplus_LTX__is_block_algorithm
saferplus_LTX__mcrypt_algorithm_version
saferplus_LTX__mcrypt_decrypt
saferplus_LTX__mcrypt_encrypt
saferplus_LTX__mcrypt_get_algorithms_name
saferplus_LTX__mcrypt_get_block_size
saferplus_LTX__mcrypt_get_key_size
saferplus_LTX__mcrypt_get_size
saferplus_LTX__mcrypt_get_supported_key_sizes
saferplus_LTX__mcrypt_self_test
saferplus_LTX__mcrypt_set_key
serpent_LTX__is_block_algorithm
serpent_LTX__mcrypt_algorithm_version
serpent_LTX__mcrypt_decrypt
serpent_LTX__mcrypt_encrypt
serpent_LTX__mcrypt_get_algorithms_name
serpent_LTX__mcrypt_get_block_size
serpent_LTX__mcrypt_get_key_size
serpent_LTX__mcrypt_get_size
serpent_LTX__mcrypt_get_supported_key_sizes
serpent_LTX__mcrypt_self_test
serpent_LTX__mcrypt_set_key
tripledes_LTX__is_block_algorithm
tripledes_LTX__mcrypt_algorithm_version
tripledes_LTX__mcrypt_decrypt
tripledes_LTX__mcrypt_encrypt
tripledes_LTX__mcrypt_get_algorithms_name
tripledes_LTX__mcrypt_get_block_size
tripledes_LTX__mcrypt_get_key_size
tripledes_LTX__mcrypt_get_size
tripledes_LTX__mcrypt_get_supported_key_sizes
tripledes_LTX__mcrypt_self_test
tripledes_LTX__mcrypt_set_key
twofish_LTX__is_block_algorithm
twofish_LTX__mcrypt_algorithm_version
twofish_LTX__mcrypt_decrypt
twofish_LTX__mcrypt_encrypt
twofish_LTX__mcrypt_get_algorithms_name
twofish_LTX__mcrypt_get_block_size
twofish_LTX__mcrypt_get_key_size
twofish_LTX__mcrypt_get_size
twofish_LTX__mcrypt_get_supported_key_sizes
twofish_LTX__mcrypt_self_test
twofish_LTX__mcrypt_set_key
wake_LTX__is_block_algorithm
wake_LTX__mcrypt_algorithm_version
wake_LTX__mcrypt_decrypt
wake_LTX__mcrypt_encrypt
wake_LTX__mcrypt_get_algo_iv_size
wake_LTX__mcrypt_get_algorithms_name
wake_LTX__mcrypt_get_block_size
wake_LTX__mcrypt_get_key_size
wake_LTX__mcrypt_get_size
wake_LTX__mcrypt_get_supported_key_sizes
wake_LTX__mcrypt_self_test
wake_LTX__mcrypt_set_key
xtea_LTX__is_block_algorithm
xtea_LTX__mcrypt_algorithm_version
xtea_LTX__mcrypt_decrypt
xtea_LTX__mcrypt_encrypt
xtea_LTX__mcrypt_get_algorithms_name
xtea_LTX__mcrypt_get_block_size
xtea_LTX__mcrypt_get_key_size
xtea_LTX__mcrypt_get_size
xtea_LTX__mcrypt_get_supported_key_sizes
xtea_LTX__mcrypt_self_test
xtea_LTX__mcrypt_set_key

Sections

.text
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8bf9e76c78db414baee0cf7b645cd77a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

version

crypt32

urlmon

wininet

gdi32

shell32

psapi

Exports

Exports

Sections

.text Size: 356KB - Virtual size: 356KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 19KB - Virtual size: 49KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 28KB - Virtual size: 28KB

.text
Size: 356KB - Virtual size: 356KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 19KB - Virtual size: 49KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 28KB - Virtual size: 28KB