ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953

Sharing

Copy URL

Twitter E-mail

General

Target

ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953
Size

138KB
MD5

1f0116315b4d88e64c547b066e72dda2
SHA1

8cb6479225564ec4165295e34abb89cbbc6b20ee
SHA256

ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953
SHA512

a55e70064101f08cdbd2d0ea9f49e69d049cef536f1806c5633806b75093e404bf9214e1867af7145b25e0bb8cb0cf9dcd4693bf1ca16ab0e311cb11a3c6d909
SSDEEP

3072:oc5+bBl3E2df1PdolVR5huqWmnZf0iCd8ke183czW3sKcNUdHKd+Nv50fJcQ5nmF:oc5+Vl3E8xdolxv95KpHM+NQXrq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953

Files

ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953
.exe windows:5 windows x86 arch:x86

42323dd0f81505720d9fadb727e7321d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
CloseHandle
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
MapViewOfFile
UnmapViewOfFile
SetEvent
SetThreadPriority
CreateFileMappingW
CreateEventW
GetCurrentThreadId
TlsAlloc
TlsFree
lstrcmpiA
GetThreadContext
SetThreadContext
InitializeCriticalSection
LeaveCriticalSection
HeapCreate
GetProcessId
VirtualProtect
CreateRemoteThread
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileIntW
ResetEvent
TlsGetValue
TlsSetValue
TerminateProcess
ExitProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
WTSGetActiveConsoleSessionId
GlobalLock
GlobalUnlock
MoveFileExW
GetUserDefaultUILanguage
GetLocalTime
HeapDestroy
FindNextFileW
lstrcmpiW
WaitForMultipleObjects
RemoveDirectoryW
LoadLibraryA
FindClose
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
ReadProcessMemory
Sleep
GetProcAddress
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
GetFileAttributesExW
GetFileAttributesW
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
GetModuleHandleW
WaitForSingleObject
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
LocalFree
GetVersionExW
EnterCriticalSection
GetNativeSystemInfo

user32

EqualRect
PrintWindow
IsRectEmpty
GetSystemMetrics
CharLowerBuffA
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
GetMenu
GetDCEx
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
PeekMessageA
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
CreateDesktopW
SetProcessWindowStation
GetClipboardData
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
CharLowerW
MapVirtualKeyW
GetWindowRect
GetParent
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
MapWindowPoints
GetKeyboardState
ToUnicode
GetMessageA
SetCapture
GetCapture
ReleaseCapture
GetMessagePos
GetUpdateRect
DrawIcon
SetCursorPos
RegisterClassExW
GetIconInfo
IntersectRect
ExitWindowsEx
EndPaint
DispatchMessageW
GetWindow
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
RegisterClassW
GetUserObjectInformationW
SendMessageW
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
SwitchDesktop
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
CharLowerA
GetWindowLongW
TranslateMessage
GetCursorPos

advapi32

ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
GetLengthSid
InitiateSystemShutdownExW
IsWellKnownSid
EqualSid
RegEnumKeyExW

shlwapi

wvnsprintfW
StrStrIW
StrStrIA
StrCmpNIW
PathRenameExtensionW
PathIsURLW
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
DeleteDC
GdiFlush
SetViewportOrgEx
SelectObject
CreateCompatibleDC
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
SetRectRgn
CreateCompatibleBitmap

ws2_32

WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
WSAEventSelect
WSASend
getpeername
recvfrom
sendto
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42323dd0f81505720d9fadb727e7321d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB