a07edacf10fb92be5c7d16ae37f226f571b569b4c9eb08c48d8e46009ad303a1N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a07edacf10fb92be5c7d16ae37f226f571b569b4c9eb08c48d8e46009ad303a1N.exe
Size

223KB
MD5

cf3ebe79774079aa315725d0996fcce0
SHA1

8c5577396ca6d2da53a1de3389b435f5d699bca2
SHA256

a07edacf10fb92be5c7d16ae37f226f571b569b4c9eb08c48d8e46009ad303a1
SHA512

d4fead288ed12f04d794eddccbe32d47d72196896a906b9e63bf2445b9a4a4a0b71cac4a8b16ffc10ead275a5b0560405274689423dc038f805b3d9c0ae8a500
SSDEEP

6144:+woIxQEiHVG8W+rCjr1mpTFO1v5G7LwwPDqsksdH2f:BK+JX1mu1v5G797qsksdW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a07edacf10fb92be5c7d16ae37f226f571b569b4c9eb08c48d8e46009ad303a1N.exe

Files

a07edacf10fb92be5c7d16ae37f226f571b569b4c9eb08c48d8e46009ad303a1N.exe
.dll windows:6 windows x86 arch:x86

604a7fd817bac198d16c4294891f23cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

advpack.pdb

Imports

msvcrt

malloc
_XcptFilter
free
_ultow
_setjmp3
longjmp
_wtoi
_wtol
_vsnprintf
_vsnwprintf
memcpy
memmove
_amsg_exit
_adjust_fdiv
_initterm
wcsncmp
_wcsicmp
_wcsnicmp
bsearch
memset

user32

SendMessageW
SetWindowPos
SendDlgItemMessageW
LoadStringW
CharNextW
ReleaseDC
GetDC
GetWindowRect
CharPrevW
CharUpperW
GetSystemMetrics
MessageBoxW
MessageBeep
DispatchMessageW
MsgWaitForMultipleObjects
PeekMessageW
ExitWindowsEx
EndDialog
EnableWindow
GetDlgItem
SetWindowTextW
GetDesktopWindow
GetDlgItemTextW
SetDlgItemTextW
DialogBoxParamW
OemToCharA
IsWindow
ShowWindow
DestroyWindow
UpdateWindow
CreateDialogParamW
CharNextA

gdi32

CreateFontIndirectW
GetObjectW
GetStockObject
GetDeviceCaps
DeleteObject

kernel32

LoadLibraryA
MulDiv
VirtualAlloc
MultiByteToWideChar
WideCharToMultiByte
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
GetFileTime
ReadFile
SetFileTime
WritePrivateProfileSectionW
GetProfileStringW
lstrcmpiA
GetProcessHeap
HeapAlloc
GetLocalTime
HeapFree
GetFullPathNameW
GetSystemInfo
SearchPathW
GetPrivateProfileIntW
FindFirstFileW
FindNextFileW
FindClose
lstrcmpiW
GetCurrentProcess
GetSystemDirectoryW
MoveFileW
MoveFileExW
CopyFileW
GetPrivateProfileSectionW
CreateProcessW
CreateDirectoryW
SetFileAttributesW
GetVolumeInformationW
CompareStringW
ExpandEnvironmentStringsW
GetShortPathNameW
FormatMessageW
RemoveDirectoryW
CreateFileMappingW
MapViewOfFileEx
SetLastError
GetUserDefaultUILanguage
LoadLibraryExW
LoadLibraryW
FindResourceExW
MapViewOfFile
GetLocaleInfoW
GetSystemDefaultUILanguage
Sleep
UnmapViewOfFile
GetLastError
lstrlenW
GetDriveTypeW
LocalFree
GetEnvironmentVariableW
CloseHandle
WriteFile
CreateFileW
WritePrivateProfileStringW
LockResource
LoadResource
SizeofResource
FindResourceW
GetTempFileNameW
GetWindowsDirectoryW
GetTempPathW
LocalAlloc
lstrlenA
SetFilePointer
GetModuleFileNameW
DeleteFileW
LocalReAlloc
GetVersionExW
DisableThreadLibraryCalls
lstrcmpW
GetPrivateProfileStringW
FreeLibrary
GetFileAttributesW
GetProcAddress
GetFileSize

advapi32

RegFlushKey
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyW
RegUnLoadKeyW
RegLoadKeyW
RegSaveKeyW
RegCloseKey
RegDeleteKeyW
EqualSid
GetTokenInformation
RegDeleteValueW
AllocateAndInitializeSid
FreeSid
RegEnumValueW
RegSetValueW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

ole32

OleInitialize
OleUninitialize
CoTaskMemFree

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

setupapi

SetupCloseInfFile
SetupDefaultQueueCallbackW
SetupOpenAppendInfFileW
SetupOpenInfFileW
SetupSetDirectoryIdW
SetupGetLineTextW
SetupFindNextLine
SetupFindFirstLineW
SetupGetStringFieldW
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupCommitFileQueueW
SetupInitDefaultQueueCallbackEx
SetupQueueCopyW
SetupOpenFileQueue
SetupInstallFromInfSectionW

shlwapi

StrStrIW
StrChrW
PathAddBackslashW
ord215
ord217
StrRChrW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathBuildRootW
PathCombineW

Exports

Exports

AddDelBackupEntry
AddDelBackupEntryA
AddDelBackupEntryW
AdvInstallFile
AdvInstallFileA
AdvInstallFileW
CloseINFEngine
DelNode
DelNodeA
DelNodeRunDLL32
DelNodeRunDLL32A
DelNodeRunDLL32W
DelNodeW
DoInfInstall
DoInfInstallA
DoInfInstallW
ExecuteCab
ExecuteCabA
ExecuteCabW
ExtractFiles
ExtractFilesA
ExtractFilesW
FileSaveMarkNotExist
FileSaveMarkNotExistA
FileSaveMarkNotExistW
FileSaveRestore
FileSaveRestoreA
FileSaveRestoreOnINF
FileSaveRestoreOnINFA
FileSaveRestoreOnINFW
FileSaveRestoreW
GetVersionFromFile
GetVersionFromFileA
GetVersionFromFileEx
GetVersionFromFileExA
GetVersionFromFileExW
GetVersionFromFileW
IsNTAdmin
LaunchINFSection
LaunchINFSectionA
LaunchINFSectionEx
LaunchINFSectionExA
LaunchINFSectionExW
LaunchINFSectionW
NeedReboot
NeedRebootInit
OpenINFEngine
OpenINFEngineA
OpenINFEngineW
RebootCheckOnInstall
RebootCheckOnInstallA
RebootCheckOnInstallW
RegInstall
RegInstallA
RegInstallW
RegRestoreAll
RegRestoreAllA
RegRestoreAllW
RegSaveRestore
RegSaveRestoreA
RegSaveRestoreOnINF
RegSaveRestoreOnINFA
RegSaveRestoreOnINFW
RegSaveRestoreW
RegisterOCX
RegisterOCXW
RunSetupCommand
RunSetupCommandA
RunSetupCommandW
SetPerUserSecValues
SetPerUserSecValuesA
SetPerUserSecValuesW
TranslateInfString
TranslateInfStringA
TranslateInfStringEx
TranslateInfStringExA
TranslateInfStringExW
TranslateInfStringW
UserInstStubWrapper
UserInstStubWrapperA
UserInstStubWrapperW
UserUnInstStubWrapper
UserUnInstStubWrapperA
UserUnInstStubWrapperW

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

604a7fd817bac198d16c4294891f23cd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

user32

gdi32

kernel32

advapi32

ole32

version

setupapi

shlwapi

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 111KB

.data Size: 3KB - Virtual size: 55KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 112KB - Virtual size: 111KB

.data
Size: 3KB - Virtual size: 55KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 6KB - Virtual size: 6KB