ba393834e5b4470b8988a383c6005cd8822bc07909a6776550eb645c8428b34cN

Sharing

Copy URL Twitter E-mail

General

Target

ba393834e5b4470b8988a383c6005cd8822bc07909a6776550eb645c8428b34cN
Size

220KB
MD5

1e8dd9913ec63e91745d91e18470bc40
SHA1

954116187a24f68d0cece155dba1a283cf2b498d
SHA256

ba393834e5b4470b8988a383c6005cd8822bc07909a6776550eb645c8428b34c
SHA512

0d8b214fb24c55324b59f4430bb5884965c212e13d5c678b87736efb79cbb8d5b7aafaa68f28c95645065a0031b3b1eb2e6b6d547e21fe31b367352d06349ae0
SSDEEP

6144:D0i0DZtSlqqDLPyOjODvcDjoG1oPKajg3G3VmnO76kI:D0i0DZtBqn8cDjoGyPKaE3+d7XI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba393834e5b4470b8988a383c6005cd8822bc07909a6776550eb645c8428b34cN

Files

ba393834e5b4470b8988a383c6005cd8822bc07909a6776550eb645c8428b34cN
.exe windows:5 windows x86 arch:x86

cbd5f9d3d5116a19f639b439cc5737cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
Process32FirstW
RemoveDirectoryW
QueryDosDeviceW
Process32NextW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
SetThreadPriority
lstrcmpiA
SetHandleInformation
CreatePipe
SetEvent
OpenEventW
GetCurrentThreadId
TlsSetValue
TerminateProcess
ResetEvent
FindClose
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetNativeSystemInfo
GetVersionExW
WTSGetActiveConsoleSessionId
GlobalLock
GlobalUnlock
MoveFileExW
GetCommandLineW
SetErrorMode
GetComputerNameW
DuplicateHandle
GetCurrentProcessId
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateRemoteThread
GetModuleHandleA
GetUserDefaultUILanguage
GetFileAttributesW
lstrcpynW
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
LoadLibraryW
WideCharToMultiByte
Thread32First
VirtualAllocEx
VirtualProtectEx
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
lstrlenW
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
MapViewOfFile
Thread32Next
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
WaitForSingleObject
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
lstrcmpiW
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
GetFileAttributesExW
GetProcessId
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
VirtualFreeEx
InitializeCriticalSection
SetThreadContext
GetThreadContext
ExitProcess
CloseHandle
WaitForMultipleObjects
CreateEventW
GetLocalTime
ExitThread
GetTickCount
TlsGetValue

user32

CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
CharLowerBuffA
GetTopWindow
LoadImageW
WindowFromPoint
IsRectEmpty
CharToOemW
GetWindowLongW
CharLowerA
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
GetMenuState
GetMessageA
GetUpdateRgn
GetMessageW
RegisterClassExA
GetWindowDC
SetCapture
SendMessageW
PrintWindow
EqualRect
PostThreadMessageW
IntersectRect
DrawEdge
GetWindowInfo
PostMessageW
GetSystemMetrics
MessageBoxA
GetKeyboardLayoutList
MapVirtualKeyW
GetKeyboardState
ToUnicode
GetWindowRect
GetParent
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
MapWindowPoints
ExitWindowsEx
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenuItemRect
GetMenu
TrackPopupMenuEx
SystemParametersInfoW
CharLowerW
GetClassNameW
DefDlgProcW
DefFrameProcA
OpenInputDesktop
GetMenuItemCount
HiliteMenuItem
EndMenu
GetWindowThreadProcessId
GetShellWindow
DrawIcon
BeginPaint
GetUpdateRect
GetDC
GetCapture
TranslateMessage
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
GetDCEx
PeekMessageA
ReleaseDC
DefWindowProcA
GetCursorPos
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
GetIconInfo
EndPaint
FillRect
ReleaseCapture
RegisterClassW
CallWindowProcA
CallWindowProcW
DefWindowProcW
GetMessagePos
DefFrameProcW
RegisterClassA
MsgWaitForMultipleObjects

advapi32

CreateProcessAsUserA
CreateProcessAsUserW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
AllocateAndInitializeSid
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
RegOpenKeyExW
GetSecurityDescriptorSacl
CheckTokenMembership
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW
SetSecurityInfo
ConvertSidToStringSidW
InitiateSystemShutdownExW
EqualSid
RegDeleteValueW
RegEnumValueW
IsWellKnownSid
GetLengthSid
RegEnumKeyExW

shlwapi

PathMatchSpecW
StrStrIW
StrStrIA
PathQuoteSpacesW
PathRenameExtensionW
StrCmpNIW
PathIsURLW
wvnsprintfA
StrCmpNIA
UrlUnescapeA
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

DeleteObject
GetDIBits
GetDeviceCaps
CreateDIBSection
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
SelectObject
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap

ws2_32

send
gethostbyname
closesocket
WSASend
getaddrinfo
listen
WSASetLastError
freeaddrinfo
inet_addr
getpeername
recvfrom
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
WSAEventSelect
getsockname
accept
bind
recv
sendto
setsockopt
shutdown
WSAGetLastError
select
socket

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore

wininet

HttpSendRequestW
HttpOpenRequestA
HttpOpenRequestW
InternetSetFilePointer
HttpSendRequestA
InternetSetStatusCallbackA
HttpAddRequestHeadersA
InternetGetCookieA
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetQueryOptionA
InternetOpenA
HttpAddRequestHeadersW
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpEndRequestW
InternetReadFile
HttpSendRequestExA
HttpQueryInfoA
HttpSendRequestExW
InternetQueryDataAvailable
InternetReadFileExA
HttpEndRequestA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cbd5f9d3d5116a19f639b439cc5737cd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 208KB - Virtual size: 207KB

.data Size: 2KB - Virtual size: 11KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 208KB - Virtual size: 207KB

.data
Size: 2KB - Virtual size: 11KB

.reloc
Size: 8KB - Virtual size: 8KB