cc65ac89bc3b7a8381d9a0ed6bc58e3508cc6e2597d21b335d262845a6df5a85N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cc65ac89bc3b7a8381d9a0ed6bc58e3508cc6e2597d21b335d262845a6df5a85N.exe
Size

307KB
MD5

ec38bfb3e731d7f215f1a0752dd766d0
SHA1

ef4aca32707784e7038906497bb5b9dd56455b57
SHA256

cc65ac89bc3b7a8381d9a0ed6bc58e3508cc6e2597d21b335d262845a6df5a85
SHA512

9e642a1fd4650a2cf0f99217406c39db7021b24e95f864d21091ea9b34f360c33a0cb9876498ab7e9e83c0a90f85177c0ee8a05e9027a5ac3cd64ac543d85e15
SSDEEP

6144:l6fTAnNXtnRJfmkqEiZD8mWCMm87gpxyN90vEB:kfTAnPnRYsXm0gy90

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc65ac89bc3b7a8381d9a0ed6bc58e3508cc6e2597d21b335d262845a6df5a85N.exe

Files

cc65ac89bc3b7a8381d9a0ed6bc58e3508cc6e2597d21b335d262845a6df5a85N.exe
.exe windows:6 windows x86 arch:x86

ddc91ecd17d943e2ee26d62fc9a4fb0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wusa.pdb

Imports

advapi32

RegCloseKey
InitiateSystemShutdownExW
RegSetValueExW
RegCreateKeyExW
CreateProcessAsUserW
RegDeleteKeyW
RegQueryValueExW
RegEnumKeyW
RegDeleteValueW
ConvertSidToStringSidW
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
CopySid
GetTokenInformation
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteKeyValueW
ControlTraceW
EnableTrace
CloseTrace
StartTraceW
GetLengthSid
IsValidSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
CryptReleaseContext
DecryptFileA
CryptGenRandom
CryptAcquireContextW
EventRegister
EventUnregister
EventWrite
EventEnabled

kernel32

ProcessIdToSessionId
GetCurrentProcessId
FormatMessageW
CreateFileW
GetFullPathNameW
GetCurrentProcess
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
InterlockedIncrement
LocalFree
MultiByteToWideChar
GetFileAttributesA
CreateDirectoryA
GetSystemDirectoryA
RemoveDirectoryW
MoveFileExW
DeleteFileW
lstrcmpW
CreateDirectoryW
OutputDebugStringW
lstrlenW
GetFileAttributesW
GetSystemDirectoryW
WaitForSingleObject
GetExitCodeProcess
GetExitCodeThread
FindFirstFileW
lstrcmpiW
FindNextFileW
GetSystemWindowsDirectoryW
InterlockedDecrement
GetLastError
CloseHandle
GetCommandLineW
CreateThread
FreeLibrary
GetProcAddress
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
FindClose

gdi32

GetStockObject
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreateCompatibleDC
SelectObject
GetTextExtentPoint32W
DeleteDC

user32

GetClientRect
FillRect
EndPaint
SetRect
SendDlgItemMessageW
GetDC
ReleaseDC
SetWindowLongW
ShowWindow
SystemParametersInfoW
MessageBoxW
PostMessageW
BeginPaint
DestroyAcceleratorTable
TranslateAcceleratorW
RegisterClassExW
CreateWindowExW
ShutdownBlockReasonCreate
ShutdownBlockReasonDestroy
DestroyWindow
DefWindowProcW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
PeekMessageW
SetFocus
EnableWindow
GetDlgItem
SetDlgItemTextW
UpdateWindow
LoadCursorW
LoadIconW
EndDialog
DialogBoxParamW
CreateAcceleratorTableW
SendMessageW

msvcrt

memmove
??3@YAXPAX@Z
_vsnwprintf
memset
wcsrchr
_controlfp
?terminate@@YAXXZ
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memcpy
_vsnprintf
_ftol2
_wcsnicmp
iswdigit
wcschr
_wcsicmp
??2@YAPAXI@Z

ole32

CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize

oleaut32

SysFreeString
VariantInit
SysAllocString

shell32

CommandLineToArgvW
SHGetPathFromIDListW
ShellExecuteExW
SHBrowseForFolderW
ord730

shlwapi

StrToIntExW

ntdll

WinSqmEndSession
WinSqmSetString
WinSqmStartSession
WinSqmSetDWORD

dpx

DpxNewJob

wtsapi32

WTSQueryUserToken

comctl32

InitCommonControlsEx

Sections

.text
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pdnglhl
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ddc91ecd17d943e2ee26d62fc9a4fb0c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shell32

shlwapi

ntdll

dpx

wtsapi32

comctl32

Sections

.text Size: 201KB - Virtual size: 201KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 19KB - Virtual size: 47KB

pdnglhl Size: - Virtual size: 4KB

.text
Size: 201KB - Virtual size: 201KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 19KB - Virtual size: 47KB

pdnglhl
Size: - Virtual size: 4KB