78ffd946c0e361c6e480dd86d51cd9baa690e93f139edd47f386a28bc4e9f3e3N

Sharing

Copy URL Twitter E-mail

General

Target

78ffd946c0e361c6e480dd86d51cd9baa690e93f139edd47f386a28bc4e9f3e3N
Size

213KB
MD5

03eda849b4b6dbc1e1a86863f6ebcb50
SHA1

42d0bc7e1abb7f784ffed2c19a9504e20d31e1a7
SHA256

78ffd946c0e361c6e480dd86d51cd9baa690e93f139edd47f386a28bc4e9f3e3
SHA512

ee981a328b89bdfa07ca580379fe2b8ae6a876c0e3dc1717a0c8cdc9e5e3c33a697e49167422fd93fb122941dbe056a2378e19e74d89b829acd723ec9f56a471
SSDEEP

3072:hWByy3Wf2fDXfp2yh7QnTwi7UF7VhIZoJnPOOvm:hWByyF7fcMUnTwiYTXP5u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78ffd946c0e361c6e480dd86d51cd9baa690e93f139edd47f386a28bc4e9f3e3N

Files

78ffd946c0e361c6e480dd86d51cd9baa690e93f139edd47f386a28bc4e9f3e3N
.exe windows:4 windows x86 arch:x86

3db6a8a04f5e2fdb09541392d63c5209

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameW
GetTempPathW
GetModuleFileNameW
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateThread
GetCurrentThreadId
GetCommandLineW
lstrcmpiA
ReadFile
CreateFileW
WideCharToMultiByte
GetProcAddress
OpenMutexW
CreateMutexW
InterlockedDecrement
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
Sleep
WaitForMultipleObjects
ResetEvent
SetEvent
GetTickCount
OpenProcess
OpenEventW
lstrlenW
lstrlenA
MultiByteToWideChar
GetCurrentProcess
FlushInstructionCache
ReleaseMutex
lstrcmpiW
WaitForSingleObject
LCMapStringW
LCMapStringA
CompareStringA
FreeEnvironmentStringsW
GetCPInfo
IsBadWritePtr
FreeEnvironmentStringsA
VirtualFree
HeapCreate
EnterCriticalSection
CloseHandle
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
SetHandleCount
GetModuleHandleA
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
HeapAlloc
HeapReAlloc
GetTimeZoneInformation
ExitThread
TlsGetValue
HeapFree
ResumeThread
RtlUnwind
TlsSetValue
LocalFree
GetEnvironmentStringsW
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
CreateEventW
GetModuleFileNameA
UnhandledExceptionFilter
TerminateThread
GetLastError
SetLastError
TlsAlloc
WriteFile
SetFilePointer
GetStartupInfoA
GetFileType
GetStdHandle
GetSystemTime
GetStringTypeA
IsBadCodePtr
InterlockedExchange
HeapSize
TerminateProcess
RaiseException
VirtualAlloc
GetLocalTime
GetStringTypeW
FlushFileBuffers
IsBadReadPtr
ExitProcess
GetVersion
GetCommandLineA
GetEnvironmentStrings
SetStdHandle
GetStartupInfoW
SetUnhandledExceptionFilter

user32

LoadStringW
GetClientRect
SetRectEmpty
PostMessageW
DefWindowProcW
DestroyWindow
SetTimer
SendMessageW
IsWindow
KillTimer
SetWindowLongW
GetWindowLongW
CallWindowProcW
CreateWindowExW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
GetMessageW
PostThreadMessageW
CharNextW
EndPaint
IsChild
GetFocus
BeginPaint

gdi32

RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
DeleteDC

advapi32

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW

ole32

CoCreateInstance
CoLoadLibrary
StringFromCLSID
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateGuid

oleaut32

VariantCopy
VariantChangeType
VariantInit
SysStringByteLen
LoadRegTypeLi
DispCallFunc
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantClear
SysStringLen

atl

ord44
ord11
ord23
ord20
ord32
ord30
ord45
ord43
ord10
ord21
ord17
ord18
ord57
ord16
ord58
ord26
ord27

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

shlwapi

PathFileExistsW

wininet

InternetSetCookieW
InternetCrackUrlA

ws2_32

gethostbyname
inet_addr
sendto
WSACleanup
closesocket
gethostname
htons
WSAGetLastError
socket
htonl
inet_ntoa
WSAStartup
ntohl
recvfrom
bind

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hhqg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3db6a8a04f5e2fdb09541392d63c5209

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

atl

version

shlwapi

wininet

ws2_32

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 20KB - Virtual size: 22KB

.rsrc Size: 32KB - Virtual size: 28KB

.hhqg Size: 4KB - Virtual size: 4KB

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 20KB - Virtual size: 22KB

.rsrc
Size: 32KB - Virtual size: 28KB

.hhqg
Size: 4KB - Virtual size: 4KB