9ee5c293fac6b2ffe814f7f1ed5ab2e5bfc6aaf08743fd511d287be4acbd7459N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

9ee5c293fac6b2ffe814f7f1ed5ab2e5bfc6aaf08743fd511d287be4acbd7459N.exe
Size

5.0MB
MD5

d33d518c6c805441b419c70412a97b60
SHA1

3daf435e9efc960a4af1938feb213b59ae62635b
SHA256

9ee5c293fac6b2ffe814f7f1ed5ab2e5bfc6aaf08743fd511d287be4acbd7459
SHA512

9a4add731a1d0fd00c13b7a1bf82c5f19e3378b7fe70dae03c71eb89be470751034b7fbc39fff3bef14efd0a61aed836db37a4363187010f837c187e02cda89e
SSDEEP

98304:gqTQ5IvXDChYELUJkTWV+r6zT0o4f1TzGOnfFbAhNNSWwyvYKM8m:RTQ5IvXDCOMU+TZ6zgPbAhNmyvYl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ee5c293fac6b2ffe814f7f1ed5ab2e5bfc6aaf08743fd511d287be4acbd7459N.exe

Files

9ee5c293fac6b2ffe814f7f1ed5ab2e5bfc6aaf08743fd511d287be4acbd7459N.exe
.exe windows:4 windows x86 arch:x86

d296c07f976e6ebdb839dc41c93bea46

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer5_Release\TeamViewer\release\TeamViewer.pdb

Imports

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

DrawDibDraw
DrawDibOpen
DrawDibClose

winmm

waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveInReset
waveInAddBuffer
waveInUnprepareHeader
waveInClose
timeBeginPeriod
timeEndPeriod
waveOutUnprepareHeader
waveOutWrite
waveOutPause
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutReset
waveOutRestart
mixerClose
mixerGetID
mixerOpen
mixerSetControlDetails
waveInStart
waveOutClose

comctl32

ImageList_ReplaceIcon
ImageList_Remove
ImageList_Create
ImageList_SetBkColor
InitCommonControlsEx

ws2_32

htons
sendto
socket
setsockopt
select
WSASetEvent
__WSAFDIsSet
recv
ntohs
htonl
WSAGetLastError
shutdown
closesocket
gethostname
inet_ntoa
gethostbyname
WSAStartup
WSACleanup
inet_addr
ioctlsocket
WSACloseEvent
WSAResetEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
send
getpeername
connect
getsockopt
recvfrom
bind
accept
listen
getsockname

sensapi

IsNetworkAlive

kernel32

SetPriorityClass
GetExitCodeThread
TryEnterCriticalSection
CreateThread
ResetEvent
GetCurrentThread
LocalLock
LocalSize
LocalUnlock
SetProcessShutdownParameters
GlobalFree
GlobalHandle
CompareStringA
GetModuleHandleA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
LoadResource
WriteFile
FlushFileBuffers
FreeLibrary
InterlockedExchange
InterlockedIncrement
SetEnvironmentVariableA
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
GetOEMCP
GetConsoleMode
GetConsoleCP
SetHandleCount
HeapCreate
ExitThread
LCMapStringA
GetStringTypeA
GetStdHandle
GetFileType
ExitProcess
GetStartupInfoA
GetCommandLineA
RtlUnwind
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
CreateWaitableTimerA
SetWaitableTimer
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
CreateFileMappingA
MapViewOfFileEx
SetEndOfFile
UnmapViewOfFile
FormatMessageA
GetFileTime
GetThreadLocale
GetACP
GetVersionExA
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
InterlockedCompareExchange
GetOverlappedResult
ResumeThread
DeviceIoControl
LocalAlloc
GetUserDefaultLCID
GetLocaleInfoA
SetUnhandledExceptionFilter
FindNextFileA
CreateFileA
FindFirstFileA
FileTimeToLocalFileTime
DeleteFileA
InterlockedDecrement
LockResource
LocalFileTimeToFileTime
SetFileTime
SetFilePointer
SystemTimeToFileTime
FindClose
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetErrorMode
CompareFileTime
GetLocalTime
HeapAlloc
VirtualAlloc
VirtualFree
SetThreadPriority
GetPriorityClass
LocalFree
ReleaseMutex
GetCommandLineW
ReadFile
GetTickCount
CreateEventA
ReleaseSemaphore
WaitForSingleObject
CloseHandle
DuplicateHandle
GetCurrentProcess
GetCurrentThreadId
SetEvent
GetSystemTimeAsFileTime
CreateSemaphoreA
GetProcessHeap
HeapFree
SetLastError
EnterCriticalSection
LeaveCriticalSection
RaiseException
FlushInstructionCache
WaitForMultipleObjects
GetCurrentProcessId
Sleep
InitializeCriticalSection
DeleteCriticalSection
OpenProcess
MulDiv
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
SizeofResource
GetFileSize
CreateMutexA
GetModuleFileNameA

user32

SetThreadDesktop
GetIconInfo
OpenInputDesktop
GetCursorInfo
GetWindowRgn
CreateIconIndirect
InvalidateRgn
MsgWaitForMultipleObjects
GetSystemMenu
GetCapture
DestroyAcceleratorTable
GetThreadDesktop
GetSysColor
GetWindowPlacement
SetWindowPlacement
EndDeferWindowPos
DrawEdge
BeginDeferWindowPos
GetNextDlgTabItem
FlashWindow
GetDialogBaseUnits
MapDialogRect
DeferWindowPos
DrawIconEx
GetMessagePos
GetUserObjectInformationW
SendDlgItemMessageA
SetTimer
InflateRect
ShowWindow
MoveWindow
GetWindow
TranslateMessage
CloseDesktop
IsMenu
CreateMenu
SetDlgItemTextA
FrameRect
DestroyCursor
DrawFocusRect
UnregisterClassA
OpenDesktopW
GetWindowRect
MapWindowPoints
SetWindowPos
InvalidateRect
IsWindow
DestroyWindow
GetParent
GetCursorPos
ScreenToClient
KillTimer
GetClientRect
BeginPaint
GetDlgItemTextA
CreateWindowExA
CreatePopupMenu
SetScrollPos
ScrollWindowEx
GetScrollInfo
SetScrollInfo
GetSysColorBrush
SetParent
MessageBeep
GetWindowDC
WindowFromPoint
GetShellWindow
SetRectEmpty
DestroyIcon
BlockInput
ReleaseDC
EndPaint
TrackMouseEvent
PtInRect
EnableMenuItem
SetFocus
DestroyMenu
RedrawWindow
GetDoubleClickTime
SetCursorPos
OffsetRect
RegisterWindowMessageA
IsChild
SetWindowContextHelpId
SetWindowRgn
SetRect
GetSubMenu
CheckMenuRadioItem
ClientToScreen
TrackPopupMenuEx
CheckMenuItem
RemoveMenu
GetDC
GetDesktopWindow
BringWindowToTop
GetDlgItem
UpdateWindow
IntersectRect
SetForegroundWindow
ShowScrollBar
CopyRect
GetSystemMetrics
FillRect
AdjustWindowRect
IsIconic
IsRectEmpty
UnionRect
EndDialog
GetActiveWindow
EqualRect
GetForegroundWindow
GetWindowThreadProcessId
GetGUIThreadInfo
EnumWindows
IsWindowVisible
SetCursor
ReleaseCapture
UnhookWindowsHookEx
ToAscii
GetKeyboardState
ToUnicode
GetKeyState
SendInput
GetFocus
MessageBoxA
GetMenuState
SetActiveWindow
ChildWindowFromPointEx
PostQuitMessage
DeleteMenu
GetMenuItemCount
GetMenuItemID
IsWindowEnabled
GetDlgCtrlID
GetKeyboardLayout
ActivateKeyboardLayout
GetAsyncKeyState
SetCapture
GetCursor
EmptyClipboard
SetClipboardData
CloseClipboard
SetClipboardViewer
ChangeClipboardChain
OpenClipboard
CallNextHookEx

gdi32

SetDIBitsToDevice
FrameRgn
CreateRoundRectRgn
GetDIBits
GetSystemPaletteEntries
GetDCOrgEx
CreatePalette
SetBrushOrgEx
SetStretchBltMode
GetObjectType
RealizePalette
SelectPalette
MaskBlt
CreateDIBSection
RoundRect
CreatePatternBrush
PatBlt
CreateBitmap
GetPixel
SetPixel
SetViewportOrgEx
SetWindowOrgEx
DPtoLP
SetDIBColorTable
SetTextColor
Polygon
Ellipse
GetDeviceCaps
DescribePixelFormat
GetPixelFormat
LineTo
MoveToEx
CreateCompatibleBitmap
StrokeAndFillPath
EndPath
BeginPath
SetBkMode
OffsetRgn
SetRectRgn
PtInRegion
CreateRectRgnIndirect
SelectClipRgn
BitBlt
CreateSolidBrush
CreatePen
Rectangle
RectInRegion
CombineRgn
CreateRectRgn
CreateCompatibleDC
SetBkColor
StretchBlt
SelectObject
CreatePolygonRgn
GetStockObject
DeleteDC
DeleteObject

advapi32

CreateProcessAsUserW
RegCloseKey
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
CryptAcquireContextA
GetSidIdentifierAuthority
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
SetTokenInformation
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
FreeSid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LookupAccountNameW
CryptReleaseContext
GetTokenInformation
EqualSid
InitializeSecurityDescriptor
CryptGenRandom
SetSecurityDescriptorDacl

shell32

SHAppBarMessage
ord680
CommandLineToArgvW
ord155
DragAcceptFiles
SHGetSpecialFolderLocation

ole32

OleInitialize
StringFromGUID2
CreateStreamOnHGlobal
CoGetClassObject
CoInitializeSecurity
CLSIDFromProgID
CLSIDFromString
OleUninitialize
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CoCreateInstance
OleLockRunning
CoTaskMemRealloc

oleaut32

SysAllocString
OleCreatePropertyFrame
SysStringByteLen
OleCreateFontIndirect
SafeArrayGetElement
LoadTypeLi
SysAllocStringLen
SysStringLen
SafeArrayGetDim
VariantInit
VariantClear
VariantCopy
VariantChangeType
VarUI4FromStr
SysFreeString
LoadRegTypeLi

iphlpapi

GetAdapterIndex
DeleteIPAddress
GetAdaptersInfo
GetIpAddrTable
GetIfEntry
GetBestInterface

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

shlwapi

PathCompactPathW
PathRemoveFileSpecW

wininet

HttpSendRequestA
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
HttpQueryInfoA
InternetQueryDataAvailable
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetErrorDlg
InternetReadFile
InternetOpenW
InternetSetOptionW
InternetQueryOptionW
InternetCloseHandle

crypt32

CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature
CertFreeCertificateContext

imagehlp

ImageGetCertificateHeader
ImageEnumerateCertificates
ImageGetCertificateData

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 177KB - Virtual size: 741KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d296c07f976e6ebdb839dc41c93bea46

Headers

File Characteristics

PDB Paths

Imports

avicap32

msvfw32

winmm

comctl32

ws2_32

sensapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

mpr

shlwapi

wininet

crypt32

imagehlp

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 177KB - Virtual size: 741KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 100KB - Virtual size: 104KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 177KB - Virtual size: 741KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 100KB - Virtual size: 104KB