28722a4e37c4fe4f8d2f34bcef04bd0cb3eae1f889b14d12b46d01f7bbe670ddN

Sharing

Copy URL

Twitter E-mail

General

Target

28722a4e37c4fe4f8d2f34bcef04bd0cb3eae1f889b14d12b46d01f7bbe670ddN
Size

191KB
MD5

40914d249d263ee8e36de70590e03360
SHA1

19c21d9a7b606dd3330428c843247a4ef47defbd
SHA256

28722a4e37c4fe4f8d2f34bcef04bd0cb3eae1f889b14d12b46d01f7bbe670dd
SHA512

7f99ceaa2bc4d6f9c10c5a3959e717b88e00a82d6391a2fff6c1cfc22d0bd31067ed0a29c3f8d0585c47cd7e7cdffdce82482d4ac740490166fddb13262b49d2
SSDEEP

3072:YAKEsYqqjfipJWYpWJZfGXFxUYyaJC6sOMD5Qjj9jRMKSlJ8subptbbG+X:LKE+qjfipJWYpWJZfGXFRJJRsOM9+j5L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28722a4e37c4fe4f8d2f34bcef04bd0cb3eae1f889b14d12b46d01f7bbe670ddN

Files

28722a4e37c4fe4f8d2f34bcef04bd0cb3eae1f889b14d12b46d01f7bbe670ddN
.exe windows:5 windows x86 arch:x86

59b7c12b805e8f464a99915a7933b0f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
SetEvent
CreateEventA
GlobalLock
GlobalUnlock
LoadLibraryA
GetLogicalDrives
GetDiskFreeSpaceExA
CreateFileW
CompareStringW
GetStringTypeW
HeapSize
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
FlushFileBuffers
WriteConsoleW
IsProcessorFeaturePresent
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreatePipe
GetFileAttributesA
LCMapStringW
IsValidCodePage
GetOEMCP
GetFileTime
GetDriveTypeA
SetFileTime
GetTickCount
OpenFile
GetCurrentProcessId
IsDebuggerPresent
GetSystemTime
GetLocalTime
LocalFree
GetVersionExA
GetModuleHandleA
GlobalMemoryStatusEx
GlobalFree
GetProcAddress
GlobalAlloc
GetCurrentProcess
CreateThread
CreateToolhelp32Snapshot
GetModuleFileNameA
Process32Next
TerminateProcess
CreateProcessA
TerminateThread
OpenProcess
WaitForSingleObject
Process32First
SetErrorMode
EndUpdateResourceA
EnumResourceNamesA
LoadLibraryExA
BeginUpdateResourceA
LockResource
GetBinaryTypeA
UpdateResourceA
LoadResource
FreeLibrary
FreeResource
FindResourceA
OpenFileMappingA
CloseHandle
CreateFileMappingA
SetLastError
GetLastError
UnmapViewOfFile
GetACP
GetCPInfo
LoadLibraryW
InterlockedDecrement
GetCurrentThreadId
RaiseException
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
HeapCreate
GetCurrentDirectoryW
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
SetFilePointer
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
ReadFile
MapViewOfFile
SetFileAttributesA
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DuplicateHandle
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
CreateDirectoryA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
HeapFree
HeapAlloc
HeapReAlloc
DeleteFileA
GetModuleHandleW
ExitProcess
DecodePointer
Sleep
GetSystemTimeAsFileTime
MultiByteToWideChar

user32

CloseClipboard
GetWindowThreadProcessId
GetKeyboardLayout
GetForegroundWindow
CallNextHookEx
GetKeyState
UnhookWindowsHookEx
DispatchMessageA
SetWindowsHookExA
TranslateMessage
GetClipboardData
ReleaseDC
GetDC
MessageBoxA
EmptyClipboard
OpenClipboard
GetWindowRect
EnumWindows
GetWindowTextA
GetDesktopWindow
IsWindowVisible
SetClipboardData
GetMessageA

gdi32

SelectObject
CreateCompatibleBitmap
CreateDIBSection
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC

advapi32

CheckTokenMembership
SetSecurityDescriptorDacl
RegEnumKeyA
RegOpenKeyA
LookupAccountSidW
ConvertStringSidToSidA
OpenSCManagerA
StartServiceA
CreateServiceA
ChangeServiceConfig2A
DeleteService
CloseServiceHandle
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
SetKernelObjectSecurity
FreeSid
AllocateAndInitializeSid
GetTokenInformation
ConvertSidToStringSidA
OpenProcessToken
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor

shell32

ShellExecuteA

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantInit

shlwapi

SHDeleteKeyA

wininet

InternetConnectA
InternetReadFile
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
HttpOpenRequestA
InternetGetConnectedState
HttpSendRequestA
InternetOpenA

winmm

mciSendStringA

wsock32

connect
WSAStartup
send
gethostbyname
closesocket
socket
recv
htons

iphlpapi

GetAdaptersInfo

gdiplus

GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipFree
GdipAlloc
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipCloneImage

mpr

WNetEnumResourceA
WNetOpenEnumA
WNetCloseEnum

netapi32

NetUserAdd
NetLocalGroupAddMembers

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59b7c12b805e8f464a99915a7933b0f8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

iphlpapi

gdiplus

mpr

netapi32

Sections

.text Size: 143KB - Virtual size: 142KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 14KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 143KB - Virtual size: 142KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 14KB

.reloc
Size: 11KB - Virtual size: 11KB