a61af6ad2deed3a183a1a8ecfa4778bb41365ce1bfab72093db03462d4226265N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a61af6ad2deed3a183a1a8ecfa4778bb41365ce1bfab72093db03462d4226265N.exe
Size

1.2MB
MD5

a4d88a3cd8de405fde2a45a79ff1fbb0
SHA1

8d5155fcdcce36f15e35cc3136d33bbee85cde5a
SHA256

a61af6ad2deed3a183a1a8ecfa4778bb41365ce1bfab72093db03462d4226265
SHA512

92fb0adabf0ed8c958f5b3827ec8fed6e4a31cf982d8c7215f84895b701dace25e38a71d98deb08b667d08b71d6fa3f23be945f283ae7dd6778b8eb426992689
SSDEEP

24576:7onfJ4whdqkdd8bsQHtVyICQs0oC9C6BDKKZw65CKrEH7G:7ZodWsQHt3CQdI6BDKKZw65C8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a61af6ad2deed3a183a1a8ecfa4778bb41365ce1bfab72093db03462d4226265N.exe

Files

a61af6ad2deed3a183a1a8ecfa4778bb41365ce1bfab72093db03462d4226265N.exe
.dll windows:4 windows x86 arch:x86

1c6457c3bd609364df37941faae294ce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mpr

WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum

shell32

FindExecutableA
ShellExecuteA
FindExecutableW
ShellExecuteW
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteExA

advapi32

OpenThreadToken
GetAce
AddAce
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetLengthSid
CopySid
LogonUserW
AddAccessAllowedAce
GetSecurityDescriptorDacl
GetAclInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptSetHashParam
CryptCreateHash
CryptImportKey
CryptAcquireContextA
CryptExportKey
CryptDeriveKey
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueA
RegQueryValueW
CreateProcessAsUserA
CreateProcessAsUserW
AdjustTokenPrivileges
OpenProcessToken
InitializeAcl
LookupPrivilegeValueA
RegEnumKeyExA
GetTokenInformation
RegUnLoadKeyA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegCreateKeyExA
RegUnLoadKeyW
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyExW
RegConnectRegistryA
RegLoadKeyA
RegLoadKeyW
RegSetValueExA
RegSetValueExW
RegEnumValueA
RegEnumKeyA
RegEnumKeyW
RegQueryInfoKeyW
RegEnumKeyExW
ImpersonateLoggedOnUser
LogonUserA
RevertToSelf

ole32

CoGetClassObject
CLSIDFromString
OleLockRunning
CreateStreamOnHGlobal
OleUninitialize
MkParseDisplayName
CreateBindCtx
CoUninitialize
CoCreateInstance
CoInitialize
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
BindMoniker
OleInitialize

oleaut32

VariantChangeType
SafeArrayCreate
VarBstrFromCy
SafeArrayGetDim
SafeArrayDestroy
VariantClear
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetLBound
VariantCopy
VariantInit
GetActiveObject
SysFreeString
SysAllocString
SysAllocStringLen
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringByteLen
LHashValOfNameSys
CreateDispTypeInfo
DispInvoke
DispGetIDsOfNames
OleCreateFontIndirect
OleLoadPicturePath
SysStringByteLen
GetErrorInfo
SafeArrayGetElement
SafeArrayLock
SafeArrayUnlock
SafeArrayGetElemsize
SafeArrayGetVartype
VarDateFromStr
VarCyFromStr
VarDecFromStr
SafeArrayPutElement
VariantCopyInd
SafeArrayGetUBound

version

VerInstallFileA
GetFileVersionInfoSizeA
VerFindFileA
VerQueryValueA
GetFileVersionInfoA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comctl32

ord17

msvfw32

DrawDibClose
DrawDibDraw
DrawDibOpen
DrawDibRealize

winmm

mciGetErrorStringA
mciSendStringA
sndPlaySoundA
mixerSetControlDetails
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen

crypt32

CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenStore
CertSetCertificateContextProperty
CertGetEnhancedKeyUsage

kernel32

CompareStringA
IsBadCodePtr
SetUnhandledExceptionFilter
CompareStringW
LCMapStringW
LCMapStringA
FlushFileBuffers
GetCPInfo
GetOEMCP
GetACP
GetCurrentProcessId
QueryPerformanceCounter
HeapSize
VirtualQuery
InterlockedExchange
RaiseException
GetFullPathNameW
UnhandledExceptionFilter
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
SetStdHandle
VirtualProtect
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateDirectoryW
InterlockedIncrement
InterlockedDecrement
RemoveDirectoryW
GlobalFree
GlobalLock
GlobalAlloc
lstrlenW
lstrcpyA
lstrlenA
GlobalUnlock
GlobalFlags
GlobalHandle
lstrcpynA
lstrcpynW
VirtualFree
CloseHandle
WriteFile
SetErrorMode
CreateFileA
ReadFile
MultiByteToWideChar
MoveFileA
DeleteFileA
MoveFileW
DeleteFileW
GetLastError
CopyFileA
CopyFileW
lstrcatA
lstrcatW
lstrcpyW
FindClose
FindNextFileA
GlobalReAlloc
lstrcmpA
FindFirstFileA
FindNextFileW
FindFirstFileW
CreateFileW
SetFilePointer
SearchPathA
SearchPathW
WideCharToMultiByte
lstrcmpiA
SetFileAttributesA
SetFileAttributesW
GetFileAttributesA
GetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
GetTempFileNameA
GetTempPathA
GetTempFileNameW
GetTempPathW
GetProcAddress
GetModuleHandleA
GetVersionExA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
IsDBCSLeadByte
GetDriveTypeA
GetCurrentDirectoryA
GetDriveTypeW
GetCurrentDirectoryW
GetEnvironmentVariableA
GetEnvironmentVariableW
FileTimeToSystemTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetProfileStringA
GetProfileIntA
GetTimeFormatA
GetDateFormatA
GetShortPathNameA
GetShortPathNameW
GetWindowsDirectoryA
GetFullPathNameA
lstrcmpiW
GetFileSize
GetTickCount
ConnectNamedPipe
WaitForSingleObject
CreateEventA
CreateNamedPipeA
PeekNamedPipe
GetOverlappedResult
DisconnectNamedPipe
SetNamedPipeHandleState
FreeLibrary
LoadLibraryA
GetPrivateProfileStringA
GetModuleFileNameA
OutputDebugStringA
Sleep
VirtualAlloc
GetSystemInfo
WritePrivateProfileStringA
WriteProfileStringA
GetExitCodeProcess
FormatMessageA
SetEnvironmentVariableA
GetModuleFileNameW
FormatMessageW
SetEnvironmentVariableW
GetComputerNameA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
SetLastError
CreateProcessA
GetComputerNameW
lstrcmpW
CreateProcessW
MulDiv
GetCurrentProcess
GetCurrentThread
SetSystemPowerState
SetLocalTime
MoveFileExA
SetComputerNameA
SetComputerNameW
TerminateProcess
OpenProcess
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
IsBadReadPtr
IsBadWritePtr
LockResource
LoadResource
FindResourceA
LoadLibraryExA
GetSystemTime
GetEnvironmentStrings
GlobalSize
LocalFree
LocalAlloc
GlobalMemoryStatus
GetSystemDirectoryA
GetWindowsDirectoryW
GetSystemDirectoryW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetCurrentThreadId
GetVolumeInformationA
GetFileTime
SetEndOfFile
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
EnumResourceNamesA
SizeofResource
EnumResourceLanguagesA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetCurrentDirectoryA
SetCurrentDirectoryW
DeviceIoControl
RemoveDirectoryA
CreateDirectoryA
LeaveCriticalSection

user32

GetWindow
ShowWindow
SystemParametersInfoA
CharNextA
wsprintfA
SetCursor
EndDialog
GetDlgItem
SetWindowTextA
SetDlgItemTextA
SetWindowTextW
SetDlgItemTextW
CharNextW
CharPrevA
CharUpperW
wsprintfW
ReleaseDC
GetDC
GetClientRect
MsgWaitForMultipleObjects
IsCharAlphaA
LoadStringA
DispatchMessageA
TranslateMessage
IsDialogMessageA
IsWindow
GetParent
PeekMessageA
GetAsyncKeyState
GetKeyState
IsCharAlphaNumericA
CharLowerA
GetFocus
MessageBoxA
ArrangeIconicWindows
GetDesktopWindow
ExitWindowsEx
SendMessageA
GetDialogBaseUnits
WaitForInputIdle
GetDlgItemTextA
GetWindowRect
SetProcessWindowStation
GetProcessWindowStation
IsZoomed
IsIconic
GetMenuItemID
GetMenuItemCount
GetMenuStringA
GetSubMenu
SendMessageTimeoutA
GetClassNameA
EnumWindows
EnumChildWindows
FindWindowA
PostMessageA
SendMessageW
GetWindowThreadProcessId
IsWindowVisible
GetMenu
GetWindowTextA
DlgDirListA
DlgDirSelectExA
GetMessageA
LoadIconA
CreateWindowExA
SetFocus
SendDlgItemMessageA
DestroyWindow
IsDlgButtonChecked
CheckDlgButton
EndPaint
GetSysColor
BeginPaint
PostQuitMessage
SetWindowLongA
DefWindowProcA
GetQueueStatus
SetKeyboardState
keybd_event
MapVirtualKeyA
GetKeyboardState
VkKeyScanA
CharPrevW
RegisterClassW
RegisterClassA
GetSystemMetrics
IsWindowEnabled
GetForegroundWindow
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ClientToScreen
WinHelpA
CharLowerW
EnableWindow
ScreenToClient
SendDlgItemMessageW
GetDlgItemTextW
GetClipboardData
IsClipboardFormatAvailable
CountClipboardFormats
EnumClipboardFormats
SetTimer
KillTimer
MoveWindow
DrawTextA
GetWindowLongA
SetForegroundWindow
EnableMenuItem
GetSystemMenu
GetWindowTextLengthA
GetWindowTextW
SetWindowPlacement
GetWindowPlacement
MapWindowPoints
InvalidateRect
GetTopWindow
AttachThreadInput
SetCursorPos
mouse_event
GetCursorPos
GetWindowLongW
WindowFromPoint
InSendMessage
UpdateWindow
FillRect
CreatePopupMenu
CreateMenu
AppendMenuA
PostMessageW
PeekMessageW
CreateWindowExW
DestroyAcceleratorTable
DestroyMenu
IsMenu
LoadImageA
DefDlgProcA
DefDlgProcW
GetSysColorBrush
RedrawWindow
GetDlgCtrlID
CreateAcceleratorTableA
CreateAcceleratorTableW
SetWindowLongW
UnionRect
EqualRect
GetWindowTextLengthW
DrawFocusRect
CallWindowProcA
CallWindowProcW
FrameRect
InflateRect
OffsetRect
DrawStateA
DrawStateW
DrawFrameControl
InvertRect
DrawIconEx
DefWindowProcW
GetClassNameW
DispatchMessageW
IsDialogMessageW
TranslateAcceleratorA
TranslateAcceleratorW
GetMessageW
IsChild
DlgDirListW
DlgDirSelectExW
CharLowerBuffW
CharLowerBuffA
CharUpperBuffW
CharUpperBuffA
OemToCharBuffA
CharToOemBuffA
DdeConnect
DdeFreeStringHandle
DdeCreateStringHandleA
DdeInitializeA
DdeDisconnect
DdeClientTransaction
DdeFreeDataHandle
DdeUnaccessData
DdeAccessData
DdeUninitialize
ChildWindowFromPoint
PtInRect
CloseWindowStation
CloseDesktop
OpenDesktopA
OpenWindowStationA
SetUserObjectSecurity
GetUserObjectSecurity
SetMenu
InsertMenuA
InsertMenuW
TrackPopupMenu
DrawMenuBar
InsertMenuItemA
GetMenuItemInfoA
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
SetMenuItemInfoA
GetKeyNameTextW
GetKeyNameTextA
RemoveMenu
MessageBoxW
DialogBoxParamA
DialogBoxParamW
IsWindowUnicode
ReleaseCapture
SetCapture
InvalidateRgn
GetClassInfoW
GetClassInfoA
RegisterWindowMessageA
RegisterWindowMessageW
CharUpperA
MessageBeep
SetWindowPos
LoadCursorA
DrawTextW

gdi32

GetTextMetricsW
PatBlt
ExtTextOutA
ExtTextOutW
GetClipBox
ExcludeClipRect
Rectangle
RoundRect
GetObjectA
CreateSolidBrush
Ellipse
CreateDCA
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
SelectPalette
RealizePalette
BitBlt
DeleteObject
GetSystemPaletteUse
GetSystemPaletteEntries
CreatePalette
GetTextMetricsA
TextOutA
SetBkMode
SetTextColor
SetBkColor
SelectObject
CreateICA
GetDeviceCaps
DeleteDC
GetStockObject
GetTextExtentPoint32W
GetTextExtentPoint32A
CreateRectRgn
SelectClipRgn
GetDIBColorTable
CreateHalftonePalette
CreatePen

comdlg32

GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA
ChooseFontA
ChooseColorA
CommDlgExtendedError
GetSaveFileNameW

Exports

Exports

AboutProc
AskTextBoxDlg
AskTextBoxDlgW
AskTextDlg
AskTextDlgW
ClientCallback
CmdChargeCode
CopyrightWndProc
CopyrightWndProcW
CreateMyArray
DLLServices
DebugProc
DllArrHandler
DllArrayServices
DllArrayStringsToAnsi
DllArrayStringsToUnicode
DllArraySwapElements
DllBinaryServices
DllMain
DllStoreErrorInfo
DllVarHandler
DllVarHandlerW
DoDaDllInit
DoDllAbout
ErrorMsgProc
GetVarBoxProc
HotKeyCheck
LoadMyString
LoadMyStringW
LoadStandardMenu
MenuSelectProcessing
MyDialogWndProc
MyDialogWndProc2
MyMMNotifyProc
MyVariantStrToNum
NameProc
NumericProc
OverwriteProc
OverwriteProcW
ParseStandardMenu
ParseYMDHMS
ProcessDaBatBuffer
ProcessSubExpression
StackInfoProc
UncompressBuffer
VFree
VMalloc
ViperAnswer
WinEnumChildClasses
WinEnumClose
WinEnumCloseW
WinEnumDaChild
WinEnumDaChildW
WinEnumFromProcId
WinEnumFromProcIdW
WinEnumFuncx
WinEnumFuncxW
WinEnumItem
WinEnumItemAndId
WinEnumItemAndIdW
WinEnumItemW
WinEnumXXXIcon
find_var
get_string_token
get_token
putback

Sections

.text
Size: 836KB - Virtual size: 836KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 82KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c6457c3bd609364df37941faae294ce

Headers

File Characteristics

Imports

mpr

shell32

advapi32

ole32

oleaut32

version

comctl32

msvfw32

winmm

crypt32

kernel32

user32

gdi32

comdlg32

Exports

Exports

Sections

.text Size: 836KB - Virtual size: 836KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 82KB - Virtual size: 198KB

.sxdata Size: 512B - Virtual size: 208B

.rsrc Size: 101KB - Virtual size: 100KB

.reloc Size: 43KB - Virtual size: 42KB

.text
Size: 836KB - Virtual size: 836KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 82KB - Virtual size: 198KB

.sxdata
Size: 512B - Virtual size: 208B

.rsrc
Size: 101KB - Virtual size: 100KB

.reloc
Size: 43KB - Virtual size: 42KB