e4650e321e015588030694415b45ca7faa8258149c630b811fa2e2bb80817367

Sharing

Copy URL

Twitter E-mail

General

Target

e4650e321e015588030694415b45ca7faa8258149c630b811fa2e2bb80817367
Size

3.2MB
MD5

fbcb39dd71b8ba62cdbe35e0be021326
SHA1

04425c093bf3a8b84e4610ba1880fbb2de2b38ff
SHA256

e4650e321e015588030694415b45ca7faa8258149c630b811fa2e2bb80817367
SHA512

b28e90c3cd91e58447341044f9279c3caad4b7f077720849951d3de81511a99c5435a77bb26f8f6afd691cdef05dc6c8e2ea0a330e404d6f1b0f9db10848e1f4
SSDEEP

49152:TJ8HrUdWYW9Ixpz8PnMRyjsleKnYFvPE6wuJs5W3DsJysvCKnHibArSvHr:98HrUEYW94pgAl4E6wuj34Ba9ArMr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e4650e321e015588030694415b45ca7faa8258149c630b811fa2e2bb80817367

Files

e4650e321e015588030694415b45ca7faa8258149c630b811fa2e2bb80817367
.exe windows:5 windows x86 arch:x86

89bf6fbf7116d9657db2b1b623ac1d8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DeleteService
ReportEventW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RevertToSelf
ImpersonateLoggedOnUser
RegEnumKeyW
RegOpenKeyW
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
DuplicateTokenEx
GetSidSubAuthority
GetSidSubAuthorityCount
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
RegisterEventSourceW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
EqualSid
GetLengthSid
InitializeAcl
GetAclInformation
AddAce
GetAce
AddAccessAllowedAce
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
SetFileSecurityW
GetFileSecurityW
LookupAccountNameW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource

crypt32

CryptQueryObject
CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ShellExecuteExW
SHGetFolderPathW
SHChangeNotify

shlwapi

StrStrIW
SHGetValueW
PathFileExistsW
SHSetValueW
PathAppendW
SHDeleteValueW
SHGetValueA
SHDeleteKeyW
PathAddBackslashW

user32

LoadStringW
wsprintfA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
wsprintfW

wldap32

ord143
ord46
ord211
ord60
ord50
ord301
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord41

ws2_32

WSAStartup
WSACleanup
recv
send
__WSAFDIsSet
select
WSASetLastError
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
WSAGetLastError

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
GetACP
SetConsoleCtrlHandler
ExitProcess
SetFilePointerEx
ExitThread
RtlUnwind
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
FindNextFileA
FindFirstFileA
GetSystemWindowsDirectoryW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SystemTimeToFileTime
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
GetModuleHandleExW
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
GetStdHandle
GetFileType
WaitForMultipleObjects
SleepEx
FormatMessageA
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
QueryPerformanceCounter
GetCurrentProcess
GetLastError
DeviceIoControl
CloseHandle
OutputDebugStringA
CreateFileW
SetPriorityClass
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
ReleaseMutex
CreateMutexW
GetSystemDirectoryW
GetVolumeInformationW
lstrlenW
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
DeleteFileA
DecodePointer
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetWindowsDirectoryW
GetLongPathNameW
FindClose
lstrcpyW
FindFirstFileW
FindNextFileW
GetFileSize
WriteFile
ReadFile
FileTimeToSystemTime
GetTempPathW
SetFileAttributesW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
CopyFileW
MoveFileExW
GetCurrentProcessId
GetLogicalDriveStringsW
GetEnvironmentVariableW
GetDriveTypeW
CreateDirectoryW
RemoveDirectoryW
CreateFileA
WTSGetActiveConsoleSessionId
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
OpenProcess
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VirtualAlloc
VirtualFree
GetCurrentThreadId
TerminateThread
ReadProcessMemory
Sleep
lstrcmpiW
GetModuleHandleW
QueryDosDeviceW
GetTickCount
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetSystemInfo
VirtualProtect
SetLastError
GetNativeSystemInfo
LoadLibraryA
IsBadReadPtr
FlushViewOfFile
CreateThread
GetExitCodeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
CreateEventW
GetSystemWow64DirectoryW
GetCurrentThread
GetProcessId
OutputDebugStringW
GetLocalTime
GetFileTime
SystemTimeToTzSpecificLocalTime
WaitForSingleObjectEx

oleaut32

SysFreeString
SysStringLen
SysAllocString

wtsapi32

WTSQueryUserToken

wininet

InternetCloseHandle
InternetQueryOptionW
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetReadFile
InternetOpenUrlW

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 578KB - Virtual size: 577KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 25KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 606KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

89bf6fbf7116d9657db2b1b623ac1d8d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

ole32

psapi

shell32

shlwapi

user32

wldap32

ws2_32

version

kernel32

oleaut32

wtsapi32

wininet

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 578KB - Virtual size: 577KB

.data Size: 25KB - Virtual size: 56KB

.gfids Size: 512B - Virtual size: 508B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 606KB - Virtual size: 608KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 578KB - Virtual size: 577KB

.data
Size: 25KB - Virtual size: 56KB

.gfids
Size: 512B - Virtual size: 508B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 606KB - Virtual size: 608KB