c4ea8403fcc39e0b5917c9ecd928ec57e8fa422825df3bf399d3539bdf94343f[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

c4ea8403fcc39e0b5917c9ecd928ec57e8fa422825df3bf399d3539bdf94343f.exe
Size

248KB
MD5

f9f5290e97798bc904c365374f50f9f4
SHA1

bcdbf537e009e2004172bcd32888a3a90072ff36
SHA256

c4ea8403fcc39e0b5917c9ecd928ec57e8fa422825df3bf399d3539bdf94343f
SHA512

84aa80ce030140be1d20ccf7960c01f10191259f43e2e18e1b45c2685fe2ca19e4fa8193875a25eacdf550d4c304e338326906133f0aee39dbd19b98f0ed04d4
SSDEEP

3072:rmsDm4U1esoRoNRkLUzQwF9qhnfNc5MOt8MaqHE8KXzOKSNzV9brTzTnxIH38MQL:rmgm4KoRIRkGQ4sxMMlMJ5tWHsLZOzo3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c4ea8403fcc39e0b5917c9ecd928ec57e8fa422825df3bf399d3539bdf94343f.exe

Files

c4ea8403fcc39e0b5917c9ecd928ec57e8fa422825df3bf399d3539bdf94343f.exe
.exe windows:4 windows x86 arch:x86

a0461669f8f39e4d7bc9ab4f70913b8c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

Netbios

wsock32

ntohl
listen
accept
htons
bind
inet_addr
ntohs
send
recv
socket
WSAGetLastError
setsockopt
sendto
select
recvfrom
closesocket
WSAStartup
WSACleanup
htonl

comctl32

ord17
ord6

kernel32

SetFilePointer
CreateFileA
WaitForSingleObject
GetModuleFileNameA
GetLocalTime
MoveFileA
GetLastError
DeleteFileA
GetFileSize
GetPrivateProfileStringA
WinExec
GlobalAddAtomA
GlobalDeleteAtom
GlobalFindAtomA
GetVersion
FreeLibrary
GetProcAddress
LoadLibraryA
OutputDebugStringA
GetModuleHandleA
Beep
CreateEventA
GetTickCount
InterlockedIncrement
InterlockedDecrement
VirtualFree
WaitForMultipleObjects
VirtualAlloc
GetComputerNameA
GetPrivateProfileIntA
lstrcmpA
InterlockedExchange
ResetEvent
CreateThread
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenA
CreateFileMappingA
lstrcpynA
GetConsoleCP
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
ReadFile
MultiByteToWideChar
HeapReAlloc
HeapCreate
HeapDestroy
RaiseException
GetStdHandle
GetOEMCP
GetACP
GetCPInfo
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WriteFile
GetStartupInfoA
GetProcessHeap
GetCommandLineA
RtlUnwind
GetFileAttributesA
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
ExitProcess
GetCurrentThreadId
ReleaseMutex
lstrcatA
CreateMutexA
MapViewOfFile
lstrcpyA
SetEvent
Sleep
UnmapViewOfFile
OpenEventA
OpenFileMappingA
CloseHandle
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetVersionExA

user32

LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassExA
PostQuitMessage
DrawTextA
DefWindowProcA
DestroyWindow
FindWindowA
DialogBoxParamA
PostMessageA
IsIconic
BeginPaint
GetSystemMetrics
GetClientRect
DrawIcon
EndPaint
SetTimer
KillTimer
EndDialog
UpdateWindow
LoadCursorA
SetCursor
GetCursorPos
SetForegroundWindow
LoadMenuA
GetSubMenu
EnableMenuItem
TrackPopupMenu
DestroyMenu
ShowWindow
EnableWindow
SetFocus
LoadIconA
wsprintfA
LoadImageA
LoadStringA
GetDlgItem
SetWindowTextA
SendMessageA
MessageBoxA
CreateWindowExA

gdi32

DeleteObject

advapi32

OpenSCManagerA
RegisterEventSourceA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyA
DeregisterEventSource
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
ChangeServiceConfigA
StartServiceA
ControlService
QueryServiceStatus
CreateServiceA
OpenServiceA
CloseServiceHandle
DeleteService
ReportEventA

shell32

Shell_NotifyIconA

hid

HidD_GetHidGuid
HidD_FreePreparsedData
HidP_GetCaps
HidD_GetPreparsedData
HidD_SetFeature
HidD_GetFeature
HidD_GetSerialNumberString
HidD_GetProductString
HidD_GetAttributes
HidD_FlushQueue

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

Exports

Exports

_Rockey@36

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a0461669f8f39e4d7bc9ab4f70913b8c

Headers

File Characteristics

Imports

netapi32

wsock32

comctl32

kernel32

user32

gdi32

advapi32

shell32

hid

setupapi

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 101KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 12KB - Virtual size: 58KB

.rsrc Size: 108KB - Virtual size: 108KB

.text
Size: 104KB - Virtual size: 101KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 12KB - Virtual size: 58KB

.rsrc
Size: 108KB - Virtual size: 108KB