0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4

Sharing

Copy URL

Twitter E-mail

General

Target

0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4
Size

1.8MB
MD5

f39f9c8fad7e3d2dc5918e3581a0676e
SHA1

d5d306a14f7cf9d57b79d8a67f82ab285df63d19
SHA256

0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4
SHA512

d1b7e239bbeabb339e477b2fdac0d5749ac4da6eee1068439aed1052dfe580a5c4cbcb20b3a60a58cbecbc1a40406e9340807f7c7c89a77184404e75a06e9593
SSDEEP

24576:HI8+tQayGWHPApPoXDIDauxXRhezuXtj6sD+QGR4aWR1:vwQayG0EbxXSCsW+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4

Files

0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4
.exe windows:4 windows x86 arch:x86

9344994a6782651a23d3da225f582a8d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3

mpr

WNetCloseEnum

comctl32

InitializeFlatSB

version

VerFindFileW
VerInstallFileA
VerFindFileA
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
VerInstallFileW

kernel32

Module32NextW
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WritePrivateProfileStringW
WriteFile
WriteConsoleW
WriteConsoleA
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjects
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
LeaveCriticalSection
ExitProcess
EnterCriticalSection
InitializeCriticalSection
GetCommandLineA
IsValidCodePage
lstrcmpA
CreateEventW
CreateFileA
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnumSystemLocalesA
ExitThread
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
FindResourceExW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FormatMessageA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeResource
GetACP
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetDiskFreeSpaceExW
GetDriveTypeA
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLocalTime
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileIntW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetThreadLocale
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsProcessorFeaturePresent
IsValidLocale
LCMapStringA
LCMapStringW
LoadLibraryW
LoadResource
LocalFree
LockResource
lstrlenA
lstrlenW
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenEventW
OpenProcess
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
SleepEx
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree

user32

SystemParametersInfoW
TranslateMessage
ShowWindow
SetWindowPos
SetWindowLongW
SetTimer
SetRectEmpty
UnregisterClassA

winspool.drv

SetFormW
XcvDataW
SetPortA
SetPortW
SetFormA
ClosePrinter
WaitForPrinterChange
SetPrinterDataExW
SetPrinterDataExA
SetPrinterDataW
DocumentPropertiesW
ScheduleJob
StartPagePrinter
StartDocPrinterW
StartDocPrinterA
SetPrinterW
SetPrinterA
SetJobW
SetJobA
OpenPrinterW
EnumPrintersW
WritePrinter

advapi32

StartServiceW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupPrivilegeValueW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 444KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.com528
Size: 1000KB - Virtual size: 999KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9344994a6782651a23d3da225f582a8d

Headers

File Characteristics

Imports

msvcrt

mpr

comctl32

version

kernel32

user32

winspool.drv

advapi32

Sections

.text Size: 412KB - Virtual size: 411KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 14.0MB

.tls Size: 4KB - Virtual size: 16B

.rsrc Size: 444KB - Virtual size: 444KB

.com528 Size: 1000KB - Virtual size: 999KB

.text
Size: 412KB - Virtual size: 411KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 14.0MB

.tls
Size: 4KB - Virtual size: 16B

.rsrc
Size: 444KB - Virtual size: 444KB

.com528
Size: 1000KB - Virtual size: 999KB