ffb859eeebd17e4450d013e70171d89e3475707fe4b0746c12faa41944796c61N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ffb859eeebd17e4450d013e70171d89e3475707fe4b0746c12faa41944796c61N.exe
Size

1.0MB
MD5

0d82187d8966ec5e2f387d6c278b5280
SHA1

3bbd7a30bc98009ba45f6850caf5bf988885c314
SHA256

ffb859eeebd17e4450d013e70171d89e3475707fe4b0746c12faa41944796c61
SHA512

e235eec79db5ce2f6f43303c61d97d8a3ad5d18d253c46dc2ac9d9dd71d4310edc9384e3dd6fff86795e5510651dc7387b3e2e6eacc9f03a002a56cb6ef3b0b0
SSDEEP

24576:yGt+igEhxI9qg8RVMdEU5vNYGp7oS7C+/kY:MWsqjzMdNNY78

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffb859eeebd17e4450d013e70171d89e3475707fe4b0746c12faa41944796c61N.exe

Files

ffb859eeebd17e4450d013e70171d89e3475707fe4b0746c12faa41944796c61N.exe
.exe windows:5 windows x86 arch:x86

8477b749dc3bf7a1075fbcde2eab224d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

migrate.pdb

Imports

kernel32

GetLocaleInfoA
SetLastError
UnmapViewOfFile
GetLocalTime
MapViewOfFile
GetFileType
SetFilePointer
SetEndOfFile
GetFileSize
ReadFile
WriteFile
FlushFileBuffers
CompareFileTime
SetThreadPriority
Sleep
CreateMutexA
CreateMutexW
CreateFileA
CreateFileW
CreateFileMappingA
CreateFileMappingW
GetFullPathNameA
GetFullPathNameW
GetLongPathNameA
GetLongPathNameW
LCMapStringA
LCMapStringW
DeleteFileA
GetDriveTypeA
GetDriveTypeW
GetTempFileNameA
GetTempFileNameW
GetFileAttributesA
ReleaseMutex
CreateEventA
GetModuleFileNameW
GetLocaleInfoW
LoadLibraryA
MoveFileW
GetTempPathA
FindFirstFileA
GetModuleHandleA
CreateDirectoryW
RemoveDirectoryW
GetPrivateProfileStringW
GetVersionExA
InterlockedExchange
IsValidLocale
GetVolumeInformationW
SetErrorMode
GetWindowsDirectoryW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
GetExitCodeThread
GetFileAttributesExW
DeviceIoControl
GetVersion
QueryDosDeviceW
GetUserGeoID
HeapAlloc
lstrcmpiW
GetTimeFormatW
GetUserDefaultLangID
GetSystemInfo
SystemTimeToFileTime
CopyFileW
ExitProcess
GetSystemTime
CreateEventW
WaitForMultipleObjects
SetEvent
GetProcessHeap
HeapFree
CreateThread
WaitForSingleObject
GetModuleHandleW
GetUserDefaultLCID
GetDateFormatW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalSize
RaiseException
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
GetFileAttributesW
CloseHandle
FindResourceW
LoadResource
LockResource
LocalFree
MultiByteToWideChar
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
FindClose
FindNextFileW
FindFirstFileW
SetFileAttributesW
DeleteFileW
LoadLibraryW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedCompareExchange
DebugBreak
WideCharToMultiByte
GetVersionExW
GetThreadLocale
CompareStringW
GetLastError
GetStartupInfoW
GetWindowsDirectoryA
GetACP
lstrcpyA
lstrcatA
FileTimeToSystemTime
TerminateProcess
GetCurrentProcess
lstrlenW
lstrlenA
lstrcpynW
UnhandledExceptionFilter
SetUnhandledExceptionFilter

msvcrt

bsearch
_ultow
wcscmp
wcstombs
_wcsupr
iswspace
memmove
towupper
towlower
??2@YAPAXI@Z
wcsspn
_controlfp
_onexit
__dllonexit
__set_app_type
__p__fmode
wcsstr
wcsrchr
wcsncmp
_wcsnicmp
_except_handler3
??3@YAXPAX@Z
_c_exit
_exit
_XcptFilter
_cexit
exit
wcscspn
__wgetmainargs
_initterm
strncpy
_stricmp
swprintf
atol
qsort
abs
rand
wcscat
malloc
free
srand
_beginthreadex
wcscpy
wcsncpy
strchr
isspace
toupper
realloc
_strnicmp
_vsnprintf
ceil
isdigit
isxdigit
iswcntrl
__CxxFrameHandler
memcpy
_snwprintf
memset
__setusermatherr
_wtol
_vsnwprintf
_wcsicmp
wcschr
wcspbrk
iswascii
_adjust_fdiv
_wcmdln
atoi
memcmp
floor
wcstoul
_wtoi64
iswalnum
_wtoi
iswdigit
wcslen
swscanf
_purecall
_CIpow
__p__commode

advapi32

SetFileSecurityW
GetSecurityDescriptorLength
GetSecurityDescriptorControl
IsValidSecurityDescriptor
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyW
RegEnumKeyA
GetUserNameA
RegEnumValueW
RegSetValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
GetFileSecurityW

shlwapi

PathUndecorateW
PathGetCharTypeA
PathRemoveBackslashW
PathRemoveFileSpecW
UrlCombineW
PathMakeSystemFolderW
PathGetCharTypeW

ole32

CoUninitialize
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
OleSaveToStream
OleLoadFromStream
PropVariantCopy
GetHGlobalFromStream
StringFromGUID2
CoInitializeEx
CoGetMalloc
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
PropVariantClear
StringFromIID
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CLSIDFromString
CoReleaseMarshalData
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface

oleaut32

GetErrorInfo
SysStringByteLen
SysAllocString
SysStringLen
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
VariantCopy
VariantInit
SysAllocStringByteLen
VariantClear
SysFreeString

gdi32

DeleteDC
DeleteObject
GetObjectW
CreateDIBSection
GetDIBColorTable
SelectObject
GetObjectA
GetObjectType
SetDIBColorTable
CreateICW
GetDeviceCaps
StretchBlt
MaskBlt
StretchDIBits
SetDIBitsToDevice
RectVisible
CreateCompatibleDC

user32

GetDesktopWindow
CreateWindowExW
CharNextW
GetSystemMetrics
GetMessageA
SetTimer
TranslateMessage
KillTimer
PostThreadMessageA
MessageBoxW
MsgWaitForMultipleObjects
DispatchMessageW
GetWindowLongW
SendMessageW
GetCursorPos
PtInRect
OffsetRect
WindowFromDC
CopyRect
MonitorFromRect
GetMonitorInfoW
DestroyWindow
UnregisterClassW
IsWindow
wsprintfA
PeekMessageW
CharNextA
MapWindowPoints

comctl32

InitCommonControlsEx

shell32

SHChangeNotify
SHParseDisplayName
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
SHFileOperationW

mpr

WNetAddConnection2W
WNetGetConnectionW
WNetCancelConnection2W

urlmon

CoGetClassObjectFromURL
CreateURLMoniker
CreateAsyncBindCtx

winmm

mmioOpenW
mmioSeek
mmioDescend
mmioAscend
mmioRead
mmioClose
timeBeginPeriod
timeEndPeriod
timeGetTime

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetCrackUrlW
InternetQueryOptionA
UnlockUrlCacheEntryFileW
InternetSetOptionA
RetrieveUrlCacheEntryFileW

avifil32

AVIFileInfoW
AVIFileRelease
AVIFileOpenW
AVIFileInit
AVIFileExit
AVIFileAddRef
AVIStreamRelease
AVIStreamSampleToTime
AVIStreamLength
AVIStreamReadFormat
AVIStreamInfoW
AVIFileGetStream

msimg32

TransparentBlt

Sections

.text
Size: 824KB - Virtual size: 821KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8477b749dc3bf7a1075fbcde2eab224d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

advapi32

shlwapi

ole32

oleaut32

gdi32

user32

comctl32

shell32

mpr

urlmon

winmm

version

wininet

avifil32

msimg32

Sections

.text Size: 824KB - Virtual size: 821KB

.data Size: 136KB - Virtual size: 153KB

.rsrc Size: 4KB - Virtual size: 992B

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 824KB - Virtual size: 821KB

.data
Size: 136KB - Virtual size: 153KB

.rsrc
Size: 4KB - Virtual size: 992B

.rmnet
Size: 60KB - Virtual size: 60KB