6f8050657ae7a9131ad3f2eaa5b3bb6f277af465f72ae1c22088de1ac22977edN

Sharing

Copy URL Twitter E-mail

General

Target

6f8050657ae7a9131ad3f2eaa5b3bb6f277af465f72ae1c22088de1ac22977edN
Size

142KB
MD5

369ea9719ff2904704aa6f7ae8e826b0
SHA1

583f1dc4df038f424fdc1e2664e7bfca97cc3d0c
SHA256

6f8050657ae7a9131ad3f2eaa5b3bb6f277af465f72ae1c22088de1ac22977ed
SHA512

353a0876a7c6fee13162fb29c5fa3dfe34e44825d8588fa4db582d67db0d2a777d5bbb339e5f44fa4353086b6568a997667256c919fce220ee3deec9f49636d0
SSDEEP

3072:ukB1vUZfhcaqExFltG6NLJ+R7Y5IMTL9jP465C7HgJb:u618Zfs6N1cUfTF42b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f8050657ae7a9131ad3f2eaa5b3bb6f277af465f72ae1c22088de1ac22977edN

Files

6f8050657ae7a9131ad3f2eaa5b3bb6f277af465f72ae1c22088de1ac22977edN
.exe windows:6 windows x86 arch:x86

6390cce81012bdffd3ad199754551426

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mtstocom.pdb

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
FreeSid
LookupAccountSidW
AllocateAndInitializeSid
LsaFreeMemory
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
ConvertStringSidToSidW
InitializeAcl
BuildSecurityDescriptorW
BuildTrusteeWithNameW
AddAccessAllowedAce
GetLengthSid
AddAce
GetSecurityDescriptorDacl
IsWellKnownSid
ConvertSidToStringSidW
GetSidSubAuthority
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
LsaLookupNames
SetThreadToken
OpenThreadToken
GetTokenInformation
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LogonUserW
LsaRetrievePrivateData
LsaStorePrivateData
LsaRemoveAccountRights
LsaEnumerateAccountRights
LsaAddAccountRights
IsValidSecurityDescriptor
GetSecurityDescriptorLength
OpenProcessToken
CreatePrivateObjectSecurityEx
DestroyPrivateObjectSecurity
BuildTrusteeWithSidW
RegConnectRegistryW

kernel32

LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
HeapSetInformation
GetModuleFileNameW
MoveFileExW
OpenEventW
SetEvent
GetWindowsDirectoryA
GetLastError
CreateFileA
CreateFileW
GetFileSize
CloseHandle
SetFilePointer
GetLocalTime
WriteFile
lstrlenW
lstrlenA
GetVersionExA
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
IsDebuggerPresent
GetCurrentThread
GetThreadContext
DebugBreak
CreateDirectoryW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
SetFileAttributesW
DeleteFileW
GetModuleHandleW
FindResourceW
LoadResource
InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
RegOpenKeyExW
RegFlushKey
RegDeleteValueW
RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
LoadLibraryW
FindClose
FindNextFileW
FindFirstFileW
LocalFree
LocalAlloc
LocalSize
LocalReAlloc
GetComputerNameW
CompareStringW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
FormatMessageW
LockResource

msvcrt

__CxxFrameHandler3
wcsrchr
_wcsnicmp
free
_vsnwprintf
malloc
_waccess
_local_unwind4
_wstrtime
_wcsicmp
realloc
_wstrdate
memcpy
_onexit
_lock
__dllonexit
_unlock
_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
_strtime
_stricmp
clock
wcsstr
memset
wcstombs
wcschr

user32

CharPrevA
CharNextA
IsCharAlphaW
CharPrevW
CharNextW
LoadStringW
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetDesktopWindow
SetThreadDesktop
OpenDesktopW
SetProcessWindowStation
OpenWindowStationW
GetThreadDesktop
GetProcessWindowStation
DialogBoxParamW
EndDialog
SetDlgItemTextW
CloseWindowStation
CloseDesktop
IsCharAlphaNumericW

ole32

CoTaskMemRealloc
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateInstance
CoGetObjectContext
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

version

VerQueryValueW

Exports

Exports

?GetRegNodeDispenser@@YGJPAPAUIRegNodeDispenser@@@Z

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6390cce81012bdffd3ad199754551426

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 111KB

.data Size: 512B - Virtual size: 31KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 112KB - Virtual size: 111KB

.data
Size: 512B - Virtual size: 31KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 27KB - Virtual size: 27KB