23cdaac9a5b2798d3a9f576a42e4ca33ba6366c214ea448d942f65b599721882

Sharing

Copy URL

Twitter E-mail

General

Target

23cdaac9a5b2798d3a9f576a42e4ca33ba6366c214ea448d942f65b599721882
Size

815KB
MD5

4004aca2098153e39610b6ff73ea0532
SHA1

5a740915ae47da5f4c707301c5c4370aeae03b39
SHA256

23cdaac9a5b2798d3a9f576a42e4ca33ba6366c214ea448d942f65b599721882
SHA512

749713753e29ae4cdb61dd5af365cd5c7215ea970fb53b1f84b1d2674f762b97ac841f1813ae18e94e830d62e93588588a3862d1599dcb9d3980a55028539012
SSDEEP

12288:QKV2TKHPZWkgare8jmCNFGIVX+Ffko39Nhy1VUFI/44OJWE9W:QulqXI1+Fsy9NhOVUFqIWgW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23cdaac9a5b2798d3a9f576a42e4ca33ba6366c214ea448d942f65b599721882

Files

23cdaac9a5b2798d3a9f576a42e4ca33ba6366c214ea448d942f65b599721882
.exe windows:5 windows x86 arch:x86

ecae412d75b7035032e5fbe035b595a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\web_host\web_host\Release\web_host.pdb

Imports

kernel32

LoadLibraryExW
GetModuleHandleW
DeleteFileW
IsBadReadPtr
CreateMutexW
lstrcmpiW
Sleep
SetLastError
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentProcess
VirtualProtect
InterlockedDecrement
InterlockedIncrement
GetCommandLineW
GetStartupInfoW
CreateProcessW
LoadLibraryW
CreateEventW
CloseHandle
WaitForMultipleObjects
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
GetProcAddress
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
DeviceIoControl
GetSystemWindowsDirectoryW
FreeLibrary
MultiByteToWideChar
FindResourceExW
FindResourceW
GetModuleFileNameW
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeResource
InterlockedCompareExchange
FlushFileBuffers
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
WriteConsoleW
ReadConsoleW
GetLastError
RaiseException
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetACP
GetStdHandle
LockResource
DecodePointer
ExitProcess
GetTimeZoneInformation
GetConsoleMode
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
WideCharToMultiByte
GetStringTypeW
FormatMessageW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
ReleaseMutex
WriteFile
GetPrivateProfileStringW
CreateFileW
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
ReadFile
InterlockedExchangeAdd
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileAttributesExW
SetConsoleCtrlHandler
GetFileType
SetFilePointerEx
GetConsoleCP

user32

SetForegroundWindow
GetForegroundWindow
wsprintfW
GetWindowLongW
BringWindowToTop
IsIconic
IsWindowVisible
SetWindowPos
IsWindow
CallWindowProcW
PostQuitMessage
AttachThreadInput
SendMessageTimeoutW
RegisterWindowMessageW
LoadCursorW
FindWindowW
SetWindowLongW
CharNextW
GetWindowThreadProcessId
UnregisterClassW
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
DestroyWindow
SetWindowTextW
ShowWindow

advapi32

RegQueryValueExA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken
GetTokenInformation
RegOpenKeyExA
RegEnumKeyExA
RegGetValueW

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoCreateGuid
CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAppendW
StrStrIA
StrCmpIW
PathCombineW
StrStrIW
StrCmpNIW
StrTrimA
SHGetValueA
PathRemoveExtensionW
SHSetValueA
PathFileExistsW
PathIsDirectoryW

comctl32

InitCommonControlsEx

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 443KB - Virtual size: 442KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ecae412d75b7035032e5fbe035b595a8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

version

crypt32

wintrust

wininet

iphlpapi

Sections

.text Size: 443KB - Virtual size: 442KB

.rdata Size: 149KB - Virtual size: 149KB

.data Size: 12KB - Virtual size: 20KB

.rsrc Size: 112KB - Virtual size: 112KB

.reloc Size: 90KB - Virtual size: 92KB

We care about your privacy.

.text
Size: 443KB - Virtual size: 442KB

.rdata
Size: 149KB - Virtual size: 149KB

.data
Size: 12KB - Virtual size: 20KB

.rsrc
Size: 112KB - Virtual size: 112KB

.reloc
Size: 90KB - Virtual size: 92KB