3a5c429a37ef856a2973db1ebd1c93009adfc1e4c1db61e1de7337811c33f111

Sharing

Copy URL

Twitter E-mail

General

Target

3a5c429a37ef856a2973db1ebd1c93009adfc1e4c1db61e1de7337811c33f111
Size

300KB
MD5

6ef9f0512b227f6f63626f72a354f058
SHA1

75b720e67d1a455c2d4827b67be3e187990656d5
SHA256

3a5c429a37ef856a2973db1ebd1c93009adfc1e4c1db61e1de7337811c33f111
SHA512

9402ddf3ecbc684978cda0c4df6477c5367e72e065f75c74010b77fec6bec48e3fc7eb7e413d274a3776e667549ff3706c4bf3e72799b10f8ce4dadfc68700f6
SSDEEP

6144:/Oc1yrokFyEN1dN52QJ2IW5PNZOXwrXIINpwtyj+WA7r+h:mc0rokFX1dNcQPXM1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a5c429a37ef856a2973db1ebd1c93009adfc1e4c1db61e1de7337811c33f111

Files

3a5c429a37ef856a2973db1ebd1c93009adfc1e4c1db61e1de7337811c33f111
.exe windows:5 windows x86 arch:x86

d424b51b322beca9c4207d7e270756b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

t:\delivery\x86\ship\0\ose.pdb

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
SetThreadToken
RegSetValueExW
RegEnumValueW
RegQueryValueExW
RegNotifyChangeKeyValue
SetServiceStatus
StartServiceCtrlDispatcherW
DuplicateToken
GetUserNameA
RegDeleteValueW
RegisterServiceCtrlHandlerW
CryptGetHashParam
CryptDestroyHash
CryptCreateHash
CryptHashData
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
OpenThreadToken
RegDeleteKeyW
SetFileSecurityW
CryptAcquireContextW
CryptReleaseContext

kernel32

CloseHandle
SetEvent
GetLastError
GetModuleFileNameW
lstrlenW
GetDriveTypeW
GetLogicalDrives
lstrcmpW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitProcess
Sleep
InitializeCriticalSection
GetCommandLineW
GetTickCount
ReleaseMutex
ResetEvent
WaitForMultipleObjectsEx
SetErrorMode
CreateEventW
CreateMutexW
CreateProcessW
MoveFileExW
GetSystemInfo
CreateFileA
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
WideCharToMultiByte
CreateFileW
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
WaitForMultipleObjects
CreateThread
VirtualFree
VirtualAlloc
SetFilePointerEx
GlobalFree
GlobalAlloc
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
CompareStringW
SystemTimeToFileTime
GetSystemTime
SetFileTime
SetEndOfFile
WriteFile
LocalFree
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FindClose
FindFirstFileW
GetFileSizeEx
GetFileAttributesW
GetTempPathW
CreateDirectoryW
GetCurrentThread
GetFileTime
FindNextFileW
GetStdHandle
GetFileAttributesExW
CopyFileW
CreateHardLinkW
SetFileAttributesW
DeleteFileW
GetTempPathA
RemoveDirectoryW
FormatMessageA
lstrlenA
GetComputerNameW
GetCommandLineA
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapReAlloc
RtlUnwind
GetLocaleInfoA
HeapSize
LCMapStringA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetProcessHeap

rpcrt4

RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
NdrServerCall2

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winhttp

WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCreateUrl
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSendRequest

wintrust

WinVerifyTrust

userenv

LoadUserProfileA
UnloadUserProfile

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

PACK
Size: 160KB - Virtual size: 424KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d424b51b322beca9c4207d7e270756b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

rpcrt4

version

winhttp

wintrust

userenv

Sections

.text Size: 127KB - Virtual size: 127KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

PACK Size: 160KB - Virtual size: 424KB

.text
Size: 127KB - Virtual size: 127KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

PACK
Size: 160KB - Virtual size: 424KB