4da5b627bb581cd4dced6132534ae8d744203227e2e9074d2ea93cfa1d83275dN

Sharing

Copy URL Twitter E-mail

General

Target

4da5b627bb581cd4dced6132534ae8d744203227e2e9074d2ea93cfa1d83275dN
Size

177KB
MD5

f63850ba70b17cbe5f4a9e0d5b588410
SHA1

9dedfe8b587ea1786b9fcf8df721310d0e35463d
SHA256

4da5b627bb581cd4dced6132534ae8d744203227e2e9074d2ea93cfa1d83275d
SHA512

b0f94beb31e6c34940c7f7146bb7eea75ee5fd7220a39504b2357588fb3a6fd6cfa69a911e27b7e5520b52697522dfe882306c114ccb1f5e7eec3127b6ac3ca3
SSDEEP

3072:SjfJZcHjqRiv7eLvD4RnYqA7kMGPXQ7qlxqvquMVlwYZmCITzlRROfweZbrQMPIf:kfJZajqRq6LERYq1MGPAs1uMuCGqJr30

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4da5b627bb581cd4dced6132534ae8d744203227e2e9074d2ea93cfa1d83275dN

Files

4da5b627bb581cd4dced6132534ae8d744203227e2e9074d2ea93cfa1d83275dN
.exe windows:5 windows x86 arch:x86

2a04025ade1d1c12420d12e42b9c954b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
QueryDosDeviceW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExitProcess
IsBadReadPtr
WTSGetActiveConsoleSessionId
GetThreadContext
SetThreadContext
GetProcessId
GetTimeZoneInformation
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
ExitThread
GetModuleHandleA
OpenEventW
DuplicateHandle
GetCurrentProcessId
GetLocalTime
CreateRemoteThread
Process32FirstW
Process32NextW
SetHandleInformation
CreatePipe
TlsGetValue
TlsSetValue
TerminateProcess
ResetEvent
MoveFileExW
GetUserDefaultUILanguage
GlobalLock
GlobalUnlock
GetProcessHeap
VirtualFree
GetTickCount
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
ReadFile
Thread32Next
lstrcpynW
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
VirtualQueryEx
GetFileAttributesExW
SetFileTime
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
TlsFree
TlsAlloc
GetCurrentThreadId
CreateEventW
CreateFileMappingW
SetThreadPriority
GetCurrentThread
SetEvent
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
GetModuleHandleW
CreateMutexW
LocalFree
GetVersionExW
GetNativeSystemInfo
ExpandEnvironmentStringsW
lstrcmpiW
CloseHandle
EnterCriticalSection
GetProcAddress
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
lstrcmpiA

user32

ToUnicode
GetKeyboardState
ShowWindow
SetThreadDesktop
UpdateWindow
GetKeyboardLayoutList
DrawIcon
GetIconInfo
GetCursorPos
GetSystemMetrics
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
TranslateMessage
GetClipboardData
CharLowerA
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
CharLowerBuffA
RegisterClassExA
RegisterWindowMessageW
CharLowerW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenWindowStationW
EndPaint
GetUpdateRgn
GetWindowDC
FillRect
DrawEdge
BeginPaint
GetUpdateRect
IntersectRect
GetDCEx
EqualRect
PrintWindow
GetMessageA
GetWindowRect
SetCapture
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
ReleaseCapture
IsWindow
MapWindowPoints
GetMessagePos
GetWindowLongW
IsRectEmpty
MenuItemFromPoint
GetDC
GetMenu
MapVirtualKeyW
PostMessageW
DestroyWindow
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
GetUserObjectInformationW
SendMessageW
CallWindowProcA
GetMessageW
LoadCursorW
CloseDesktop
LoadIconW
GetThreadDesktop
CreateWindowExA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
ExitWindowsEx
PeekMessageW

advapi32

InitiateSystemShutdownExW
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegEnumKeyExW
EqualSid
CreateProcessAsUserA
IsWellKnownSid
GetLengthSid
SetSecurityInfo

shlwapi

PathRemoveBackslashW
PathQuoteSpacesW
PathRenameExtensionW
StrCmpNIW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathIsURLW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance

gdi32

CreateCompatibleBitmap
SelectObject
DeleteObject
GetDeviceCaps
DeleteDC
GetDIBits
CreateDIBSection
GetStockObject
RestoreDC
SaveDC
SetRectRgn
GdiFlush
SetViewportOrgEx
CreateCompatibleDC

ws2_32

freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
WSAGetLastError
inet_addr
WSASend
gethostbyname
getpeername
WSASetLastError
closesocket
send
listen
accept
getaddrinfo
WSAStartup
WSAAddressToStringW
connect
WSAIoctl
WSAEventSelect
recvfrom
sendto
select

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetQueryOptionW
InternetCrackUrlA
InternetReadFile
InternetSetOptionA
InternetCloseHandle
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetConnectA
InternetOpenA
HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

waveOutGetVolume
PlaySoundA
PlaySoundW
waveOutSetVolume

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a04025ade1d1c12420d12e42b9c954b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 167KB - Virtual size: 166KB

.data Size: 1KB - Virtual size: 8KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 167KB - Virtual size: 166KB

.data
Size: 1KB - Virtual size: 8KB

.reloc
Size: 7KB - Virtual size: 6KB