de3aa229fdb6c11baf8a8031fe2863fd8d8daa4d6c9e02674203075c3972fedaN

Sharing

Copy URL Twitter E-mail

General

Target

de3aa229fdb6c11baf8a8031fe2863fd8d8daa4d6c9e02674203075c3972fedaN
Size

192KB
MD5

fe90e8856335fb24e0e160674ea82b00
SHA1

b2d115e8e2c7727a98eb37ffc3de45b07d43630f
SHA256

de3aa229fdb6c11baf8a8031fe2863fd8d8daa4d6c9e02674203075c3972feda
SHA512

abeb3ed25d194e1aab9127b5e7b59002ef1a61cb272971d6240f5754229ea294458955fbc9a5e908301d6984cd5d5617dc9720d5d53bd0c7d58ba430d3d1866b
SSDEEP

3072:GcVkp9m6Woxgm9XweNjEyqYd+Wv6YFmNAd8t7um31QtoaAzHoVy9ImXqjxF:m9m6WoxNFbN4CZv6OmN1AyAoa4cYdmx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de3aa229fdb6c11baf8a8031fe2863fd8d8daa4d6c9e02674203075c3972fedaN

Files

de3aa229fdb6c11baf8a8031fe2863fd8d8daa4d6c9e02674203075c3972fedaN
.exe windows:4 windows x86 arch:x86

44abb8c1bbfeb2e77f055e3349e513c6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
CharNextA

kernel32

FindNextFileA
FindFirstFileA
lstrcmpiA
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetShortPathNameA
ExpandEnvironmentStringsA
CreateFileA
SetUnhandledExceptionFilter
GetCommandLineA
WideCharToMultiByte
LocalAlloc
FreeLibrary
GetStartupInfoA
WriteFile
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
MoveFileA
GetCurrentDirectoryA
GetTempPathA
SetEnvironmentVariableA
ExitProcess
GetProcessHeap
HeapAlloc
GetModuleHandleA
LoadLibraryA
GetProcAddress
Sleep
HeapFree
GetWindowsDirectoryA
MultiByteToWideChar
GetSystemDirectoryA
lstrcatA
GetTickCount
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
CloseHandle
SetFileAttributesA
DeleteFileA
lstrlenA
lstrcpyA
GetFileAttributesA
CreateDirectoryA
GetLastError
InterlockedExchange
RaiseException
OpenEventA

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
strstr
strncpy
_strupr
__CxxFrameHandler
strcmp
strchr
strcat
memset
??2@YAPAXI@Z
memcpy
??3@YAXPAX@Z
tolower
toupper
_ftol
srand
rand
strcpy
_except_handler3
malloc
free
strlen
_strlwr
_stricmp
strncat
_CxxThrowException
_itoa
_strnicmp
_strrev

advapi32

GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupAccountNameA
GetFileSecurityA
RegCloseKey
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
ChangeServiceConfig2A
CloseServiceHandle
DeleteService
CreateServiceA
OpenSCManagerA
ControlService
StartServiceA
GetServiceKeyNameA
GetUserNameA
SetFileSecurityA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44abb8c1bbfeb2e77f055e3349e513c6

Headers

File Characteristics

Imports

user32

kernel32

msvcrt

advapi32

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 164KB - Virtual size: 163KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 164KB - Virtual size: 163KB

.rsrc
Size: 4KB - Virtual size: 3KB