e119e72f91bb738f68ea5a530cc9a3d820d8365839c58598717a05e3ef833622[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

e119e72f91bb738f68ea5a530cc9a3d820d8365839c58598717a05e3ef833622.exe
Size

4.8MB
MD5

a49c371a28c6904f4f2e26e88598d9ba
SHA1

ceb762eac0e3cee561b8db0e7e6068a568eedb7c
SHA256

e119e72f91bb738f68ea5a530cc9a3d820d8365839c58598717a05e3ef833622
SHA512

2db92377bc19f308c68f298605b8ffb742e6f1cb1cb1d02baf9a7afba5b74e46eadb005418cfe9d403e2c556eaaaefd3c46ac3b82b57bec77cb703cf00a11049
SSDEEP

49152:iA2QfOK2B4ErgDABNogo7A2QjOxA2QjOGA2QjORA2QjOF24vx6s/AY/MDETxaWal:iBK+Lrg0g71x1G1R1Hvx6IF/M8aWzm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e119e72f91bb738f68ea5a530cc9a3d820d8365839c58598717a05e3ef833622.exe

Files

e119e72f91bb738f68ea5a530cc9a3d820d8365839c58598717a05e3ef833622.exe
.exe windows:10 windows x86 arch:x86

afb291654f85a34f0ec0dd79ffabc278

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

cleanmgr.pdb

Imports

gdi32

ExtTextOutW
GetLayout
SetBkMode
SetTextColor
SetBkColor
GetTextExtentPoint32W

user32

GetClientRect
SetDlgItemTextW
GetParent
SendDlgItemMessageW
SetWindowLongW
CreateDialogParamW
SendMessageW
ShowWindow
LoadStringW
EnumWindows
DispatchMessageW
TranslateMessage
SetForegroundWindow
IsDialogMessageW
GetMessageW
GetSystemMetrics
DestroyIcon
DestroyWindow
DialogBoxParamW
EndDialog
SetFocus
GetSysColor
DrawIconEx
MessageBoxW
DrawFocusRect
GetWindowTextW
PostMessageW
LoadIconW
EnableWindow
GetWindowLongW
GetDlgItem

msvcrt

memcpy_s
_wcsicmp
_CIsqrt
memset
_ftol2
_vsnwprintf
toupper
_i64toa_s
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter

comctl32

ord345
CreatePropertySheetPageW
PropertySheetW
ImageList_Create
ImageList_ReplaceIcon
ord17

shell32

SHGetFileInfoW
ExtractIconExW
ord680
ShellExecuteExW

shlwapi

SHDeleteKeyW
ord487
StrFormatByteSizeW
ord271
StrCmpNW
StrCmpW
StrToIntW
StrStrIW
PathStripToRootW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateThread
TerminateProcess

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSetInformation
GetProcessHeap
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetModuleHandleExW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
SetErrorMode

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

ReleaseMutex
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
SetEvent
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateEventW
ReleaseSemaphore

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-com-l1-1-0

CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoTaskMemAlloc

api-ms-win-security-base-l1-1-0

CheckTokenMembership
CreateWellKnownSid

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetDiskFreeSpaceW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegGetValueW

oleaut32

VariantInit
SysStringLen
VariantClear

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

GetStartupInfoA
MulDiv
lstrlenW
CheckElevationEnabled

ntdll

RtlNtStatusToDosError
NtOpenProcessToken
NtOpenThreadToken
NtClose
NtQueryInformationToken

ole32

CoInitialize

vssapi

VssFreeSnapshotPropertiesInternal
CreateVssBackupComponentsInternal

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

afb291654f85a34f0ec0dd79ffabc278

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

msvcrt

comctl32

shell32

shlwapi

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

oleaut32

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-profile-l1-1-0

kernel32

ntdll

ole32

vssapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 72KB - Virtual size: 71KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 175KB - Virtual size: 175KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 72KB - Virtual size: 71KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 175KB - Virtual size: 175KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB