2ea0ee01f29c777019de07da7eb6717db41e9c70f30b0c839e0c2649df7da99fN

Sharing

Copy URL Twitter E-mail

General

Target

2ea0ee01f29c777019de07da7eb6717db41e9c70f30b0c839e0c2649df7da99fN
Size

175KB
MD5

f7b9f1ae694da6d07340431898140320
SHA1

b039b67cdfdc0669b70c5e5bdf6bcbcd4712201e
SHA256

2ea0ee01f29c777019de07da7eb6717db41e9c70f30b0c839e0c2649df7da99f
SHA512

75515d85692ceaa8abc666ae0e2a50c265a6ee47dcff78f13ca7d61b64b1df992d83ef03176c62edadd0b9c2ade25f6e6296662fc4dd546310376f7cbb1a007e
SSDEEP

3072:gJvXIlHOt+WeTodg0frxJLgf7nDVF6PUp1Yo3ICgZ5zt:mXr+lex5gfzDVlVXg7J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ea0ee01f29c777019de07da7eb6717db41e9c70f30b0c839e0c2649df7da99fN

Files

2ea0ee01f29c777019de07da7eb6717db41e9c70f30b0c839e0c2649df7da99fN
.exe windows:6 windows x86 arch:x86

53a6715f589e88c4fd4541c81b4f57c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

notepad.pdb

Imports

advapi32

RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyW
RegOpenKeyExW
IsTextUnicode
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
OpenSCManagerW

kernel32

GetFileInformationByHandle
FindNLSString
GlobalAlloc
GlobalUnlock
GlobalLock
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetUserDefaultUILanguage
HeapFree
HeapAlloc
HeapSetInformation
CreateFileMappingW
InterlockedExchange
FreeLibraryAndExitThread
GetFileAttributesW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
IsWow64Process
GetCurrentProcess
CreateThread
LoadLibraryW
GetModuleFileNameW
FormatMessageW
MapViewOfFile
MultiByteToWideChar
UnmapViewOfFile
LocalReAlloc
GetACP
DeleteFileW
SetEndOfFile
WideCharToMultiByte
SetLastError
WriteFile
GetLastError
LocalSize
GetFullPathNameW
GetStartupInfoW
MulDiv
GetCommandLineW
GetCurrentProcessId
FoldStringW
lstrcmpW
FindFirstFileW
FindClose
GetVersionExW
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
LocalLock
LocalUnlock
lstrlenW
GetLocaleInfoW
GlobalFree
lstrcmpiW
SetErrorMode
CreateFileW
ReadFile
CloseHandle
LocalAlloc
InterlockedDecrement
LocalFree
InterlockedIncrement
GetProcessHeap
UnhandledExceptionFilter

gdi32

DeleteObject
SetMapMode
SetViewportExtEx
SetWindowExtEx
LPtoDP
SetBkMode
GetTextMetricsW
SetAbortProc
StartDocW
StartPage
EndPage
AbortDoc
EndDoc
DeleteDC
TextOutW
GetTextExtentPoint32W
CreateDCW
SelectObject
GetTextFaceW
EnumFontsW
GetDeviceCaps
CreateFontIndirectW

user32

SetActiveWindow
GetKeyboardLayout
PostQuitMessage
DefWindowProcW
GetForegroundWindow
IsIconic
DestroyWindow
MessageBeep
GetWindowPlacement
CharUpperW
RegisterClassExW
LoadImageW
LoadCursorW
SetWindowLongW
LoadAcceleratorsW
GetSystemMenu
SetWindowPlacement
CreateWindowExW
RegisterWindowMessageW
UpdateWindow
InvalidateRect
SetScrollPos
GetWindowTextLengthW
GetWindowLongW
PeekMessageW
EnableWindow
DialogBoxParamW
CreateDialogParamW
GetWindowTextW
SetWindowPos
SetCursor
SetForegroundWindow
FindWindowW
GetSystemMetrics
MoveWindow
SendMessageW
CharNextW
CheckMenuItem
CloseClipboard
IsClipboardFormatAvailable
OpenClipboard
GetMenuState
EnableMenuItem
GetSubMenu
GetClientRect
ShowWindow
UnhookWinEvent
GetMenu
MessageBoxW
WinHelpW
GetDlgCtrlID
ChildWindowFromPoint
GetDC
GetFocus
DrawTextExW
ReleaseDC
LoadIconW
SetWinEventHook
GetMessageW
PostMessageW
IsDialogMessageW
TranslateAcceleratorW
EndDialog
GetDlgItemTextW
SetDlgItemTextW
SetFocus
SetWindowTextW
GetParent
LoadStringW
SendDlgItemMessageW
GetCursorPos
ScreenToClient
TranslateMessage
GetAncestor
DispatchMessageW

msvcrt

_controlfp
_vsnwprintf
memset
_wtol
memcpy
iswctype
wcsncmp
wcsrchr
_except_handler4_common
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
__getmainargs
_cexit
_exit
?terminate@@YAXXZ
__set_app_type

comdlg32

ReplaceTextW
PageSetupDlgW
PrintDlgExW
FindTextW
ChooseFontW
GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW
GetFileTitleW

shell32

DragAcceptFiles
SHAddToRecentDocs
SHGetFolderPathW
SHCreateItemFromParsingName
ShellExecuteExW
DragQueryFileW
DragFinish
ShellAboutW

winspool.drv

OpenPrinterW
ClosePrinter
GetPrinterDriverW

ole32

CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoInitialize

shlwapi

PathIsFileSpecW
SHStrDupW

comctl32

CreatePropertySheetPageW
PropertySheetW
CreateStatusWindowW
ord345

oleaut32

SysFreeString
SysAllocString

ntdll

WinSqmIncrementDWORD
RtlInitUnicodeString
NtQueryLicenseValue
WinSqmAddToStream

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

53a6715f589e88c4fd4541c81b4f57c3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comdlg32

shell32

winspool.drv

ole32

shlwapi

comctl32

oleaut32

ntdll

version

Sections

.text Size: 42KB - Virtual size: 41KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 124KB - Virtual size: 124KB

.reloc Size: 31KB - Virtual size: 32KB

.text
Size: 42KB - Virtual size: 41KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 124KB - Virtual size: 124KB

.reloc
Size: 31KB - Virtual size: 32KB