7dcf4b42eca8270e0cbe83bf60f77160N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

7dcf4b42eca8270e0cbe83bf60f77160N.exe
Size

184KB
MD5

7dcf4b42eca8270e0cbe83bf60f77160
SHA1

83210fbb285ef9753e0a926be8814a6ac8dca8e2
SHA256

b1aa90f654bae4659a8c5100d88055de6a9087130f05de35493523d59e0c2245
SHA512

e666539c163cd81d5ef62263991666357a0f9e04b873a2619a040b414aab72c88d5c654eabe99e779f9dfb9d837dff086c89967a42533aed1e1c199c45f05380
SSDEEP

3072:GwHX7m7DBUbIvyQGP+RnkcEplai0JIgoRmHQLevnLtrkqejyO2NW:GwHX7qGP+RS4IgHVL+qejyt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7dcf4b42eca8270e0cbe83bf60f77160N.exe

Files

7dcf4b42eca8270e0cbe83bf60f77160N.exe
.exe windows:6 windows x86 arch:x86

8b1502b797d8cc00cfb4e29d75200bfb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Samson\trunk2.0\miZip\Bin\Release\MizHelper.pdb

Imports

kernel32

FindResourceExW
MultiByteToWideChar
CreateEventW
ResetEvent
WaitForSingleObject
GetTickCount
EncodePointer
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetModuleFileNameW
CloseHandle
GetCurrentThreadId
GetLocalTime
EnterCriticalSection
SetLastError
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
InitializeCriticalSection
OutputDebugStringW
SetEvent
CreateDirectoryW
GetVersionExW
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcess
IsDebuggerPresent
LocalAlloc
LocalFree
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetStartupInfoW
WaitForMultipleObjects
DuplicateHandle
UnmapViewOfFile
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
InitializeCriticalSectionEx
HeapDestroy
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
Sleep
GetCommandLineW

user32

FindWindowA
SendMessageTimeoutW
PostMessageW
DefWindowProcW
GetWindowLongW
DestroyWindow
CreateWindowExW
SetWindowLongW
GetMessageW
TranslateMessage
DispatchMessageW

advapi32

ControlService
QueryServiceStatusEx
DeleteService
StartServiceW
ChangeServiceConfig2W
CreateServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteW
CommandLineToArgvW

shlwapi

PathAppendW
PathFileExistsW
StrCmpNIW

msvcp120

?uncaught_exception@std@@YA_NXZ
??0id@locale@std@@QAE@I@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z

msvcr120

_beginthreadex
memset
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
srand
_time64
sprintf
wmemcpy_s
memmove_s
??0exception@std@@QAE@ABV01@@Z
_snwprintf_s
memcpy_s
wcsncpy_s
_wtoi
_wcsicmp
wcschr
strncpy_s
fclose
_vsnwprintf_s
strrchr
fwrite
_ultow_s
wcsncmp
wcsncat_s
fopen_s
wcslen
fflush
strchr
malloc
_vsnprintf_s
_snprintf_s
_purecall
??_V@YAXPAX@Z
free
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
??9type_info@@QBE_NABV0@@Z
??8type_info@@QBE_NABV0@@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
_aligned_malloc
_aligned_free
clock
__CxxFrameHandler3
_CxxThrowException
__RTDynamicCast
memcpy

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetReadFileExA
HttpSendRequestW
InternetConnectW
HttpOpenRequestW
InternetCrackUrlW
HttpQueryInfoW
InternetOpenW
InternetSetStatusCallbackW
InternetCloseHandle

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b1502b797d8cc00cfb4e29d75200bfb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

shlwapi

msvcp120

msvcr120

version

wininet

iphlpapi

Sections

.text Size: 118KB - Virtual size: 118KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 7KB - Virtual size: 10KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 118KB - Virtual size: 118KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 7KB - Virtual size: 10KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB