de25be564045b94f05d5354ed23f05f2e8f6016efb373cf8be6b49edbdd31d25N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

de25be564045b94f05d5354ed23f05f2e8f6016efb373cf8be6b49edbdd31d25N.exe
Size

136KB
MD5

ecdf4f95b38656462984f3c63458f530
SHA1

766209dc923d9f6d23f11360ab6b9c299fdfa8e3
SHA256

de25be564045b94f05d5354ed23f05f2e8f6016efb373cf8be6b49edbdd31d25
SHA512

b48d7463ee27584383697a303a0bd4bed91e20a0c43cd5904d62891111f7f29c81df66ebe048980d166471e6cebd84a77c1517c992259d3ecf4e78a7fe6f0305
SSDEEP

3072:5QGjqfgbSJKK8fnSphSeJj+jOqUFUVh0hG0ta0/xsC/2e:yGmfWefj+qlFThGyd/xs8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de25be564045b94f05d5354ed23f05f2e8f6016efb373cf8be6b49edbdd31d25N.exe

Files

de25be564045b94f05d5354ed23f05f2e8f6016efb373cf8be6b49edbdd31d25N.exe
.dll regsvr32 windows:4 windows x86 arch:x86

231640b19384eb09e9f6030bbcc80a04

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\program files\hp\digital imaging\bin\mcpc\HPZDevEvnt.pdb

Imports

kernel32

MulDiv
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GetCurrentThreadId
lstrcatA
IsDBCSLeadByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
ExitProcess
lstrcpynA
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
lstrcpyA
lstrlenW
lstrcmpiA
lstrlenA
GetProcessHeap
HeapFree
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
InterlockedExchange
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP

user32

CharNextA
PtInRect
GetClassInfoExA
DefWindowProcA
DestroyWindow
UnregisterClassA
UnionRect
SetWindowPos
SetWindowRgn
OffsetRect
CallWindowProcA
EqualRect
IntersectRect
ReleaseDC
GetDC
SetWindowLongA
GetWindowLongA
LoadCursorA
GetKeyState
IsWindow
InvalidateRect
ShowWindow
SetFocus
IsChild
GetFocus
GetParent
EndPaint
GetClientRect
BeginPaint
CreateWindowExA
RegisterClassExA
wsprintfA

gdi32

SetViewportOrgEx
SetWindowOrgEx
SetMapMode
DeleteDC
LPtoDP
GetDeviceCaps
CreateDCA
CreateRectRgnIndirect
GetClipRgn
CreateRectRgn
SelectClipRgn
Rectangle
SetTextAlign
SaveDC
RestoreDC
TextOutA

advapi32

RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA

shell32

SHGetFileInfoA

ole32

CoTaskMemFree
StringFromCLSID
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateOleAdviseHolder
CoCreateInstance
OleLoadFromStream
WriteClassStm
OleSaveToStream
StringFromGUID2

oleaut32

VariantClear
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
LoadRegTypeLi
OleCreatePropertyFrame
SysAllocStringByteLen
SysStringByteLen
SetErrorInfo
VariantCopy
SysAllocString
LoadTypeLi
VariantChangeType
CreateErrorInfo
VariantInit
VarUI4FromStr
SysFreeString

shlwapi

PathFindExtensionA

msvcr71

_resetstkoflw
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__security_error_handler
memset
wcsncpy
_mbschr
_wcsicmp
??2@YAPAXI@Z
realloc
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
__CxxFrameHandler
??_U@YAPAXI@Z
_except_handler3
_CxxThrowException
free
malloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

231640b19384eb09e9f6030bbcc80a04

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcr71

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 56KB - Virtual size: 53KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 56KB - Virtual size: 53KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 8KB - Virtual size: 4KB