268e7364023912268edca00bcf16a5560d9d1b00e3127b81965fb2a7054c4b9f

Sharing

Copy URL

Twitter E-mail

General

Target

268e7364023912268edca00bcf16a5560d9d1b00e3127b81965fb2a7054c4b9f
Size

1.7MB
MD5

e719fe626fc762a5ac5210ceacacb1ff
SHA1

de1e4192ca19663b0afb109dcb1aced4e31dc4d7
SHA256

268e7364023912268edca00bcf16a5560d9d1b00e3127b81965fb2a7054c4b9f
SHA512

df9993419a8acac1b30b3d4de8b2658f3ea589e7c706ddcbada3844015df86ff6aa7af8aa75310213b714ae56658b9b642d5ee3a5f0778e1dbb8474aba2413aa
SSDEEP

24576:mAGqXhW6M3bGnNsf8FdURV2m/UydUBGIUS/m4khLfdHgNZPvle:A3b4rmRom/UydzIUS/m4iLfGNVs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
268e7364023912268edca00bcf16a5560d9d1b00e3127b81965fb2a7054c4b9f

Files

268e7364023912268edca00bcf16a5560d9d1b00e3127b81965fb2a7054c4b9f
.dll windows:4 windows x86 arch:x86

4762231993edb9964294f8101a69a70a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Module32First
Module32Next
GetDateFormatA
GetTimeFormatA
Process32First
Process32Next
WriteProcessMemory
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CloseHandle
WriteFile
CreateFileA
GetTickCount
FindClose
FindFirstFileA
GetModuleFileNameA
GetPrivateProfileStringA
ReadFile
GetFileSize
CreateProcessA
GetStartupInfoA
GetLocalTime
SetFilePointer
WritePrivateProfileStringA
GetEnvironmentVariableA
FindNextFileA
GetCommandLineA
FreeLibrary
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
InterlockedExchange
CreateToolhelp32Snapshot
SetEndOfFile
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
HeapSize
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
RaiseException
IsBadWritePtr
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
lstrcpyn
ResumeThread
VirtualQuery
RtlMoveMemory
GetProcAddress
LoadLibraryA
GetModuleHandleA
SetWaitableTimer
GetCurrentProcessId
CreateWaitableTimerA
WaitForSingleObject
VirtualProtectEx
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
SetLastError
TerminateProcess
OpenProcess
CreateThread
DeleteCriticalSection
VirtualAlloc
VirtualFree
Sleep
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetLastError
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetCurrentProcess
TlsAlloc
TlsFree

user32

MsgWaitForMultipleObjects
IsWindowVisible
GetWindowTextA
GetClassNameA
SetTimer
EnumChildWindows
TranslateMessage
DispatchMessageA
GetWindow
EnumWindows
GetWindowThreadProcessId
GetMessageA
PeekMessageA
wsprintfA
MessageBoxA
GetWindowInfo
GetWindowRect

shlwapi

PathFindExtensionA
PathFileExistsA
PathFindFileNameA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA

advapi32

RegCreateKeyExA
CryptCreateHash
CryptReleaseContext
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA

oleaut32

VariantTimeToSystemTime

ws2_32

WSACleanup
inet_ntoa
WSAStartup
gethostbyname

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

shell32

SHGetFolderPathW

Exports

Exports

mymain

Sections

.text
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4762231993edb9964294f8101a69a70a

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

version

wininet

advapi32

oleaut32

ws2_32

msvcrt

iphlpapi

psapi

shell32

Exports

Exports

Sections

.text Size: 460KB - Virtual size: 460KB

.sedata Size: 1.2MB - Virtual size: 1.2MB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 460KB - Virtual size: 460KB

.sedata
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB