590ae23717c3e213b112e08847e2df418a668eae74bd2179fcfcb1a09df1231eN

Sharing

Copy URL Twitter E-mail

General

Target

590ae23717c3e213b112e08847e2df418a668eae74bd2179fcfcb1a09df1231eN
Size

168KB
MD5

60c95b7bd41d972cca5778d367d17120
SHA1

525610359e1a9b2517c79ecd2cb3ac338cd81240
SHA256

590ae23717c3e213b112e08847e2df418a668eae74bd2179fcfcb1a09df1231e
SHA512

e60f0eb64b6733c1242b2303bd7a9c0e7bbc4053c5f60166d396262f25965fec72467e5c300a8beaf732078df35a4d51094e135026a5b769b5be24f53ab66e28
SSDEEP

3072:S7V3SNXUq1/6D9sqWccAkxZbd3KScuk+pxEodfSBaMKslWb:S7eX/1wSSyxd5lJpVdfSBaMKCg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
590ae23717c3e213b112e08847e2df418a668eae74bd2179fcfcb1a09df1231eN

Files

590ae23717c3e213b112e08847e2df418a668eae74bd2179fcfcb1a09df1231eN
.dll windows:0 windows x86 arch:x86

477b33aa85ee02251983b9517e70ab7c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord825
ord389
ord6059
ord3229
ord5204
ord5808
ord1988
ord500
ord772
ord540
ord800
ord5356
ord690
ord823

msvcrt

strchr
strncpy
sscanf
_EH_prolog
__CxxFrameHandler
wcscat
memcpy
malloc
free
strcpy
srand
memcmp
strrchr
strcat
time
localtime
strftime
vsprintf
sprintf
strlen
memset
rand
atoi
strcspn
strstr
_CxxThrowException
tolower
toupper
strcmp
_strcmpi
wcslen
_mbsicmp
__dllonexit
_onexit
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv

kernel32

UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetFileInformationByHandle
FileTimeToSystemTime
SystemTimeToFileTime
FormatMessageA
CreateProcessA
GetLocalTime
lstrcatA
DeviceIoControl
LocalFree
InterlockedIncrement
InterlockedExchange
CreateMutexA
GetLastError
WinExec
lstrcpyA
LoadLibraryA
GetProcAddress
CloseHandle
WriteFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetCurrentProcess
WideCharToMultiByte
WaitForSingleObject
CreateThread
GetCurrentProcessId
TerminateProcess
OpenProcess
GetTickCount
MoveFileExA
DeleteFileA
Sleep
lstrlenA
FreeLibrary
FindClose
FindNextFileA
FindFirstFileA
ReadFile
GetFileSize
InterlockedDecrement
GetSystemInfo
WriteProcessMemory
CreateDirectoryA
ReadProcessMemory
VirtualQueryEx
GlobalFree
GlobalAlloc
GetVersionExA
GetSystemDefaultUILanguage
GlobalMemoryStatusEx
MultiByteToWideChar
GetSystemDirectoryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

wsprintfA
GetDesktopWindow

advapi32

LookupPrivilegeValueA
RegQueryInfoKeyA
RegEnumValueA
AdjustTokenPrivileges
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
OpenProcessToken

ws2_32

WSACleanup
htons
closesocket
htonl
sendto
send
__WSAFDIsSet
recv
connect
setsockopt
WSAIoctl
WSAStartup
socket
ntohs
inet_addr
bind
ioctlsocket
select
recvfrom
WSAGetLastError

shlwapi

PathIsDirectoryA
PathFileExistsA
StrStrIA

ole32

CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

SafeArrayGetVartype
SafeArrayAccessData
SafeArrayUnaccessData
VariantChangeType
SysStringLen
SafeArrayCreate
SafeArrayDestroy
SysFreeString
SysAllocString
VariantClear
SysAllocStringByteLen
VariantInit

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

netapi32

Netbios

Exports

Exports

InputFile
InvCMAP
PrintFile

Sections

.text
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.desa0
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.desa1
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

477b33aa85ee02251983b9517e70ab7c

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

ws2_32

shlwapi

ole32

oleaut32

msvcp60

netapi32

Exports

Exports

Sections

.text Size: - Virtual size: 49KB

.rdata Size: - Virtual size: 13KB

.data Size: - Virtual size: 23KB

.desa0 Size: - Virtual size: 96KB

.desa1 Size: 156KB - Virtual size: 153KB

.reloc Size: 4KB - Virtual size: 172B

.rsrc Size: 4KB - Virtual size: 606B

.text
Size: - Virtual size: 49KB

.rdata
Size: - Virtual size: 13KB

.data
Size: - Virtual size: 23KB

.desa0
Size: - Virtual size: 96KB

.desa1
Size: 156KB - Virtual size: 153KB

.reloc
Size: 4KB - Virtual size: 172B

.rsrc
Size: 4KB - Virtual size: 606B