84a40bbb266bfde6e63c42d69e419123f5c990f15fb0cbe33eeeecddced05d8e

Sharing

Copy URL Twitter E-mail

General

Target

84a40bbb266bfde6e63c42d69e419123f5c990f15fb0cbe33eeeecddced05d8e
Size

178KB
MD5

32faaecbdaae55ccd3f3c2f805a36f5a
SHA1

36c765fdf0b307335cd574ca4065f3bae0b34feb
SHA256

84a40bbb266bfde6e63c42d69e419123f5c990f15fb0cbe33eeeecddced05d8e
SHA512

7a853bfa5269bd015cc27656c383ee4744cc4f1598578a11214f2d05e60b001483731fe13f3050096270e7aeca81712a39f257b74fb994f516f168085ce69d82
SSDEEP

3072:JOSxlmmMYOaYLN4hJ5THgtmAetVZ8wiNbrihtCUgGXymfH7bxfTWfZiY8GhDA5qw:c2lmmRFeqngdeSwFMGXFPRfTWhE75vD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84a40bbb266bfde6e63c42d69e419123f5c990f15fb0cbe33eeeecddced05d8e

Files

84a40bbb266bfde6e63c42d69e419123f5c990f15fb0cbe33eeeecddced05d8e
.exe windows:5 windows x86 arch:x86

f9f2168845aa6ac3519335c9d4d2fb59

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\PWWDEHM\SHkjPrmXxujJhs\aePViuYjOhAM\oonpydwkk.pdb

Imports

comctl32

ImageList_Write
CreatePropertySheetPageW
ImageList_Remove
ImageList_Create
DestroyPropertySheetPage
CreateToolbarEx

kernel32

PulseEvent
GlobalLock
LocalReAlloc
ReleaseSemaphore
CreateWaitableTimerA
GetNumberFormatA
TlsFree
GetUserDefaultLangID
CopyFileW
lstrcpyA
IsValidLanguageGroup
GlobalFindAtomW
SetTimerQueueTimer
SearchPathW
SetFileApisToOEM
GetStartupInfoW
FoldStringW
TransactNamedPipe
lstrcmpiA
FindFirstFileA
OpenFile
CopyFileA
ReadFile
GetFileAttributesExA
HeapCreate
CreateEventW
OpenSemaphoreW
GetAtomNameW
GetFileSize
LockFile
GlobalAlloc
SetLastError
GlobalFree
IsBadWritePtr
GetTempFileNameW
GetOverlappedResult
GetTimeFormatA
GetTempPathA
GetFileAttributesExW
ExitThread
LCMapStringW
GetSystemDefaultLangID
GetCurrentDirectoryW
CancelIo
LoadLibraryA
ConnectNamedPipe
GetDateFormatA
ResetEvent
UnhandledExceptionFilter
lstrcpynA
IsValidLocale
SetCommBreak
SetCurrentDirectoryA
AreFileApisANSI
GetFileType

shlwapi

PathIsUNCA

user32

CharToOemA
GetWindowRect
SetRectEmpty
GetForegroundWindow
ActivateKeyboardLayout
DefFrameProcW
SetCursor
EnumChildWindows
GetDCEx
CharUpperBuffW
DefFrameProcA
DrawIcon
GetClassNameW
GetSysColorBrush
SetTimer
GetMenuItemCount
DestroyCaret
DrawTextW
VkKeyScanW
SetForegroundWindow
SetRect
SetWindowPlacement
InternalGetWindowText
CreateIconIndirect
GetKeyNameTextW
IsWindow
PostThreadMessageW
LoadBitmapW
SendDlgItemMessageA
ScrollWindow
DrawTextExW
MapWindowPoints
SetParent
AppendMenuA
GetClassInfoA
CheckMenuRadioItem
DestroyWindow
UnloadKeyboardLayout
PostMessageW
IsChild
EnumThreadWindows
SystemParametersInfoW
LoadIconW
SetMenuDefaultItem
ShowWindowAsync
GetMonitorInfoW
BeginPaint
OffsetRect
GetWindowTextA
GetUserObjectInformationA
CreateWindowExW
SetUserObjectInformationW
LoadImageW
GetKeyState
PostMessageA
GetCaretPos
EnumWindows
CharNextExA
SetMenu
GetClipCursor
LoadStringW
DrawIconEx
MoveWindow
SetDlgItemInt
HideCaret
GetKeyboardLayoutList
AdjustWindowRectEx
InvertRect
CascadeWindows
GetLastActivePopup
GetClassLongW
TabbedTextOutW
SetDlgItemTextW
GetParent
RegisterClassExW
IsWindowUnicode
RegisterClassExA
GetMenuStringA
CharLowerA
InflateRect
DrawStateW
MessageBoxA
TrackPopupMenuEx
GetMessageExtraInfo
OemToCharBuffA
SystemParametersInfoA
GetClassInfoExW
IsCharUpperA
ShowOwnedPopups
CharPrevW
GetShellWindow
ClipCursor
SetWindowTextW
DeferWindowPos
ShowWindow
CopyRect
DragObject
InvalidateRect
DestroyIcon
GetDlgItemInt
FindWindowW
CheckRadioButton
DefWindowProcA
GetKeyboardType
SendNotifyMessageW
CharNextA
IsCharAlphaNumericW
DefDlgProcA
SetLastErrorEx
CharToOemW
CreateCursor
CreateDialogParamW
ChangeMenuW
DeleteMenu
SetPropW
RemovePropW
CreateDialogIndirectParamW
EnableScrollBar

msvcrt

wcscmp
_controlfp
mbtowc
getc
setvbuf
isprint
strncmp
__set_app_type
__p__fmode
putchar
strcoll
strtol
wcspbrk
atoi
malloc
floor
strerror
islower
strchr
wcstok
free
__p__commode
_amsg_exit
fgets
_initterm
clock
rand
fprintf
isupper
gmtime
iswalpha
memset
clearerr
_ismbblead
fclose
puts
iswspace
strstr
ungetc
exit
wcscpy
_XcptFilter
_exit
_cexit
__setusermatherr
__getmainargs
iswprint
wcstoul
srand

Exports

Exports

?ForwardControlItem@@YGK_KK:O

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.init
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.erts
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wall
Size: 1024B - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.info
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.udata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9f2168845aa6ac3519335c9d4d2fb59

Headers

File Characteristics

PDB Paths

Imports

comctl32

kernel32

shlwapi

user32

msvcrt

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 21KB

.init Size: 6KB - Virtual size: 5KB

.erts Size: 512B - Virtual size: 88B

.wall Size: 1024B - Virtual size: 256KB

.info Size: 512B - Virtual size: 192B

.data Size: 3KB - Virtual size: 2KB

.udata Size: 40KB - Virtual size: 40KB

.rsrc Size: 102KB - Virtual size: 102KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 22KB - Virtual size: 21KB

.init
Size: 6KB - Virtual size: 5KB

.erts
Size: 512B - Virtual size: 88B

.wall
Size: 1024B - Virtual size: 256KB

.info
Size: 512B - Virtual size: 192B

.data
Size: 3KB - Virtual size: 2KB

.udata
Size: 40KB - Virtual size: 40KB

.rsrc
Size: 102KB - Virtual size: 102KB

.reloc
Size: 2KB - Virtual size: 1KB