fe4452262e67ec54bb64bc76b303b5b4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

fe4452262e67ec54bb64bc76b303b5b4.exe
Size

4.9MB
MD5

fe4452262e67ec54bb64bc76b303b5b4
SHA1

2c0bdc07a45c65a736cd848b74c702f70a1c9bde
SHA256

5d1ec27eb711dbafffe07dc8debb180abd22c3ebb0104a5c393252be6f65c5c0
SHA512

e3f752d3cb18fd81ad085995fb3630e87b5da0f1e343f96e53d0e68f20eaacd13256a57fc56a8803a187a185b3a987ae8156b93e9285a84362e596c83c63e4ad
SSDEEP

98304:HLsJDV9bD55mTEbek9rEdMQWlLYzjomp2vj6CwCV1hxT5MbkOO/glN4HuQlKn:a1BQyjYzjopaiHuQl+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe4452262e67ec54bb64bc76b303b5b4.exe

Files

fe4452262e67ec54bb64bc76b303b5b4.exe
.exe windows:5 windows x86 arch:x86

dab2b776c2b3a97f800f38a1b96c16fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\VCtest\Projects\NEWGZXTEST\GZX\Release\JQMain.pdb

Imports

mfc140u

ord7447
ord11725
ord1770
ord1756
ord7481
ord2526
ord4885
ord11726
ord3697
ord9132
ord12089
ord14377
ord3838
ord11936
ord7820
ord5850
ord5813
ord2246
ord2215
ord4360
ord6497
ord2409
ord1523
ord9128
ord3147
ord4222
ord8744
ord8746
ord3872
ord968
ord6549
ord9139
ord6490
ord6129
ord9126
ord3145
ord4219
ord13806
ord6589
ord10255
ord5984
ord5790
ord12168
ord3265
ord3371
ord3372
ord3941
ord12124
ord1777
ord10472
ord4936
ord5003
ord4948
ord2993
ord4227
ord14588
ord14137
ord8965
ord4966
ord12220
ord8817
ord13628
ord4960
ord4954
ord5013
ord6978
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2761
ord8210
ord3302
ord3305
ord13756
ord6220
ord4225
ord8464
ord4323
ord1526
ord7495
ord2385
ord2389
ord462
ord8470
ord8386
ord12865
ord8324
ord5357
ord2486
ord12541
ord11002
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11982
ord11983
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord8217
ord10433
ord12251
ord12219
ord12928
ord5249
ord5549
ord5760
ord9350
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord6860
ord1113
ord6489
ord1111
ord1070
ord1447
ord6559
ord6566
ord3882
ord2304
ord1133
ord1066
ord1180
ord4092
ord13911
ord7313
ord13442
ord952
ord2205
ord7997
ord1472
ord995
ord13800
ord5419
ord12793
ord14234
ord3833
ord890
ord1391
ord11038
ord3605
ord8062
ord14364
ord13656
ord8067
ord2457
ord2458
ord13646
ord5882
ord2990
ord7653
ord10379
ord6533
ord4997
ord4942
ord5019
ord9210
ord9256
ord3266
ord4974
ord13878
ord4912
ord4927
ord9235
ord12173
ord12262
ord12258
ord4988
ord4502
ord9693
ord2760
ord4494
ord3055
ord13752
ord6218
ord1722
ord3164
ord14590
ord1744
ord7923
ord3932
ord14596
ord12542
ord3403
ord6877
ord11717
ord13703
ord5935
ord6607
ord280
ord5110
ord2477
ord5718
ord5289
ord3296
ord4886
ord1002
ord4815
ord290
ord2996
ord286
ord1045
ord296
ord265
ord266
ord1511
ord3404
ord11396
ord11015
ord9040
ord12131
ord14405
ord12921
ord8360
ord2682
ord1513

kernel32

GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetFileSize
GlobalUnlock
GlobalLock
GlobalSize
LoadLibraryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
VirtualProtect
GetFileAttributesW
CreateDirectoryW
WritePrivateProfileStringW
CreateDirectoryA
CreateEventA
CreateFileMappingA
MapViewOfFile
CreateProcessA
CloseHandle
SetEvent
CreateWaitableTimerA
TerminateThread
CancelWaitableTimer
WideCharToMultiByte
GetTickCount
CreateToolhelp32Snapshot
SizeofResource
CreateThread
GetQueuedCompletionStatus
LeaveCriticalSection
PostQueuedCompletionStatus
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
SleepEx
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetCurrentThread
QueryPerformanceFrequency
MultiByteToWideChar
InitializeCriticalSectionEx
FormatMessageW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
MoveFileExA
WaitForSingleObject
GetPrivateProfileIntW
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringW
GetFileAttributesA
CreateMutexW
OutputDebugStringW
GetVolumeInformationA
CreateFileA
Sleep
DeviceIoControl
CreateFileW
GetTempPathA
GetLastError
GetSystemInfo
SetLastError
LockResource
LoadResource
FindResourceW
Process32FirstW
OpenFileMappingW
UnmapViewOfFile
Process32NextW
OpenProcess
VirtualQuery
TerminateProcess
InitializeCriticalSection
GetProcessTimes
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
WaitForMultipleObjects
CreateIoCompletionPort
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
SetWaitableTimer
GetPrivateProfileStringA
ReadFile

user32

SetWindowLongA
PeekMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
EnableWindow
LoadIconW
MessageBoxA
CallWindowProcW
LoadMenuW
GetSubMenu
GetCursorPos
PostMessageA
GetSystemMenu
AppendMenuW
GetClientRect
MessageBoxW
GetSystemMetrics
DrawIcon
GetWindowRect
GetParent
MoveWindow
UpdateWindow
GetWindow
GetDesktopWindow
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextA
SendMessageA
GetWindowTextW
OpenClipboard
GetClipboardData
CloseClipboard
SendMessageW
IsIconic

advapi32

RegCloseKey
RegQueryValueExW
OpenSCManagerA
OpenServiceA
CloseServiceHandle
CreateServiceA
StartServiceA
ControlService
DeleteService
RegQueryValueExA
RegOpenKeyExA
OpenThreadToken
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegOpenKeyExW

shell32

SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteW
SHFileOperationW
DragQueryFileA
SHGetSpecialFolderPathW

comctl32

InitCommonControlsEx

shlwapi

StrCmpW

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Strcoll
_Strxfrm
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Xbad_function_call@std@@YAXXZ

ws2_32

freeaddrinfo
getaddrinfo
htonl
accept
__WSAFDIsSet
socket
WSACleanup
WSASetLastError
recvfrom
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
getsockopt
WSASend
send
gethostbyname
ioctlsocket
connect
inet_ntoa
select
recv
getpeername
getsockname
ntohs
shutdown
closesocket
WSAStartup
sendto
WSARecv
WSAIoctl
setsockopt
listen
bind
htons
inet_addr
WSAGetLastError
WSASocketW
WSAWaitForMultipleEvents
gethostname

plfl32

P_UserReg
P_GetDataValue
P_GetLoginValue
P_UserLogin
P_LoadSystem
P_CardReCharge

psapi

GetProcessImageFileNameA

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenW
InternetCloseHandle

iphlpapi

GetAdaptersInfo

vcruntime140

__std_terminate
memmove
memchr
strstr
memset
__CxxFrameHandler3
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_exception_copy
__std_exception_destroy
strchr
_purecall
memcpy
strrchr
_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

fseek
__p__commode
_close
fread
_set_fmode
fputs
__stdio_common_vswprintf
ftell
__stdio_common_vsscanf
fputc
__stdio_common_vsprintf
fflush
_open
_lseeki64
_fseeki64
_read
fgets
feof
_write
_fileno
fclose
fwrite
fopen
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf_s

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s
strftime
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_unlink
_fstat64
remove
_stat64
_access

api-ms-win-crt-string-l1-1-0

_strdup
strtok
strncpy
strcspn
strspn
strpbrk
toupper
strncmp

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
system
_configure_wide_argv
exit
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
__sys_nerr
__sys_errlist
_cexit
_c_exit
_beginthreadex
_initialize_wide_environment
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_errno
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
calloc
_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
atoi
_wtoll
strtoll
atoll
_wtol
wcstombs

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr
_except1

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChainEngine
CertFreeCertificateChain
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertGetCertificateChain
CryptStringToBinaryA
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

normaliz

IdnToAscii
IdnToUnicode

wldap32

ord41
ord50
ord45
ord60
ord211
ord46
ord22
ord143
ord301
ord200
ord30
ord79
ord35
ord26
ord27
ord32
ord217
ord33

Sections

.text
Size: 486KB - Virtual size: 486KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dab2b776c2b3a97f800f38a1b96c16fb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc140u

kernel32

user32

advapi32

shell32

comctl32

shlwapi

msvcp140

ws2_32

plfl32

psapi

wininet

iphlpapi

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

bcrypt

crypt32

normaliz

wldap32

Sections

.text Size: 486KB - Virtual size: 486KB

.rdata Size: 96KB - Virtual size: 96KB

.data Size: 5KB - Virtual size: 17KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 4.2MB - Virtual size: 4.2MB

.reloc Size: 28KB - Virtual size: 28KB

.text
Size: 486KB - Virtual size: 486KB

.rdata
Size: 96KB - Virtual size: 96KB

.data
Size: 5KB - Virtual size: 17KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 4.2MB - Virtual size: 4.2MB

.reloc
Size: 28KB - Virtual size: 28KB