7dbcb8ec5e4dc6eb7c7928f79ed2f867db9e815689c21c0f6a4f137cbb30366fN

Sharing

Copy URL Twitter E-mail

General

Target

7dbcb8ec5e4dc6eb7c7928f79ed2f867db9e815689c21c0f6a4f137cbb30366fN
Size

508KB
MD5

a601909d1b6528359d7856c0dc8f5fb0
SHA1

f99e2a2264c800857ddacae0e5d2327fe6c585a2
SHA256

7dbcb8ec5e4dc6eb7c7928f79ed2f867db9e815689c21c0f6a4f137cbb30366f
SHA512

823627a95cca65d415bb91c734a38133327699313a50966b0d1339cbbcd29bf5e5d39d258822af172a5fdf19fe2aa7a5855166b03244fc495fce74983bc31526
SSDEEP

6144:UAa1AhKzGat3Q2PUX2utrJ1oR8aDienS1vbBY8F6w9pc0gqJeZ04:UM2PUGutruMenS1vbBYiLpveZ0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7dbcb8ec5e4dc6eb7c7928f79ed2f867db9e815689c21c0f6a4f137cbb30366fN

Files

7dbcb8ec5e4dc6eb7c7928f79ed2f867db9e815689c21c0f6a4f137cbb30366fN
.exe windows:6 windows x86 arch:x86

47b62147ad0e6ddd61c6f2c83378d5a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wmdbexport.pdb

Imports

kernel32

CreateFileMappingA
CreateMutexA
SetThreadPriority
CompareFileTime
FlushFileBuffers
SetEndOfFile
MapViewOfFile
UnmapViewOfFile
GetLocaleInfoA
GetSystemInfo
GetFileSize
CreateFileMappingW
GetFullPathNameA
GetLongPathNameA
LCMapStringA
LCMapStringW
DeleteFileA
GetDriveTypeA
GetTempFileNameA
GetFileAttributesA
ReleaseMutex
IsValidLocale
GetVolumeInformationW
LoadLibraryW
HeapDestroy
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CompareStringW
GetThreadLocale
GetVersionExW
lstrlenW
GetLastError
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
ReadFile
WriteFile
GetVersionExA
GetProcAddress
GetModuleHandleW
CloseHandle
FreeLibrary
GetModuleFileNameW
GetUserDefaultLCID
SystemTimeToFileTime
DebugBreak
CreateMutexW
WaitForSingleObject
CreateThread
SetErrorMode
CreateDirectoryW
GetDriveTypeW
CreateFileW
DeviceIoControl
CreateFileA
GetVersion
GetLongPathNameW
QueryDosDeviceW
CopyFileW
SetFileAttributesW
GetWindowsDirectoryW
GetFullPathNameW
GetTempFileNameW
DeleteFileW
GetFileAttributesW
SetLastError
GetExitCodeThread
GetFileType
GlobalFree
GlobalAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetSystemTime
SetEvent
WaitForMultipleObjects
CreateEventW
ExitProcess
FileTimeToSystemTime
GetLocalTime
SetFilePointer
InitializeCriticalSection
DeleteCriticalSection

msvcrt

wcscpy
wcsncpy
_snwprintf
wcslen
atoi
memcmp
??3@YAXPAX@Z
wcschr
bsearch
_wcsicmp
??2@YAPAXI@Z
_purecall
_wtol
wcsncmp
wcsrchr
??_V@YAXPAX@Z
_wcsnicmp
rand
abs
qsort
iswdigit
_beginthreadex
swscanf
iswalnum
wcstoul
_CIsqrt
_CIpow
_wtoi64
floor
_wtoi
wcsstr
wcspbrk
iswspace
towupper
towlower
??_U@YAPAXI@Z
_vsnwprintf
wcstombs
malloc
free
_controlfp
memmove
memcpy
memset
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoUnmarshalInterface
CoMarshalInterface
CreateStreamOnHGlobal
CLSIDFromString
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
PropVariantCopy
StringFromCLSID
CoTaskMemFree
CoCreateGuid
PropVariantClear

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
SysStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantClear
VariantChangeType
SysStringLen

advapi32

GetFileSecurityW
SetFileSecurityW
GetSecurityDescriptorLength
GetSecurityDescriptorControl
IsValidSecurityDescriptor
TraceMessage
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW

user32

MessageBoxW
PostThreadMessageA
TranslateMessage
SetTimer
GetMessageA
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjects
CharNextA
KillTimer

shell32

SHFileOperationW
SHGetMalloc
SHGetPathFromIDListW
SHGetFolderPathW
SHGetSpecialFolderLocation

shlwapi

PathGetCharTypeA
PathUndecorateW
PathRemoveFileSpecW
PathRemoveBackslashW
PathGetCharTypeW

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

wmvcore

WMCreateEditor

Sections

.text
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rizywqu
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

47b62147ad0e6ddd61c6f2c83378d5a8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

ole32

oleaut32

advapi32

user32

shell32

shlwapi

mpr

winmm

wmvcore

Sections

.text Size: 343KB - Virtual size: 343KB

.data Size: 112KB - Virtual size: 122KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 51KB - Virtual size: 52KB

rizywqu Size: - Virtual size: 4KB

.text
Size: 343KB - Virtual size: 343KB

.data
Size: 112KB - Virtual size: 122KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 51KB - Virtual size: 52KB

rizywqu
Size: - Virtual size: 4KB