1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677

Sharing

Copy URL Twitter E-mail

General

Target

1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677
Size

113KB
MD5

de96342270a559433babd9a496b0e7a8
SHA1

061d614f75e29cc48fe846e06380ee44752e432f
SHA256

1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677
SHA512

4b2370bfd70ab89d926c960f4c03f55e53a151bafd3f5cd9315bc5511f738a04721a7e01699726845008fa8ec48a0d357e7f5523599e32bc679dbb69be1067a1
SSDEEP

3072:W912aHMhsUA9C+6cNtLJ9OnTIfLidKgbkHVGBgrr1P:W9124UAwtcNlOnTIfLidK6jBEp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677

Files

1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677
.exe windows x64

ad3aad627a35fcd353271e46b9c297a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CopyFileW
CreateDirectoryW
GetTempPathW
MoveFileExW
GetSystemDirectoryW
ExitProcess
GetTickCount
GetCommandLineW
WinExec
CreateMutexW
OpenMutexW
GetCurrentThreadId
CreateEventW
GetLastError
LocalAlloc
WaitForMultipleObjects
CreateThread
LocalFree
FlushFileBuffers
HeapReAlloc
WriteConsoleW
SetStdHandle
HeapSize
GetStringTypeW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCurrentProcess
GetCurrentProcessId
QueryPerformanceCounter
HeapCreate
GetVersion
HeapSetInformation
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RaiseException
LCMapStringW
HeapAlloc
FlsAlloc
SetLastError
FlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapFree
FindFirstFileW
FindNextFileW
CreateFileW
GetFileSize
ReadFile
Sleep
OpenProcess
VirtualAlloc
ReadProcessMemory
TerminateProcess
VirtualFree
WideCharToMultiByte
GetModuleFileNameW
SetFileAttributesW
DeleteFileW
lstrlenA
FormatMessageA
CreateProcessA
GetModuleFileNameA
CreateFileA
CloseHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MultiByteToWideChar
GetSystemTimeAsFileTime
GetStdHandle
WriteFile
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetCommandLineA
RtlUnwindEx
RtlLookupFunctionEntry
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer

user32

GetClientRect
BeginPaint
EndPaint
FillRect
SetRect
GetMessageA
SetTimer
KillTimer
GetClassLongPtrA
GetDC
ReleaseDC
WinHelpA
PostQuitMessage
LoadAcceleratorsA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadCursorA
LoadIconA
LoadImageA
RegisterClassExA
MessageBoxA
GetSystemMetrics
ShowWindow
UpdateWindow
GetInputState
PostThreadMessageA
RegisterClassA
FindWindowW
PostMessageA
wsprintfW
OpenClipboard
EmptyClipboard
CloseClipboard
SendMessageA
LoadStringA
EndDialog
GetDlgItem
SetFocus
InvalidateRect
DialogBoxParamA
CreateWindowExA
GetWindowLongPtrA
SetWindowLongPtrA
DefWindowProcA

gdi32

FillRgn
GetStockObject
SetMapMode
SelectPalette
RealizePalette
SetWindowExtEx
SetViewportExtEx
SetViewportOrgEx
CreateSolidBrush
DeleteObject
GetDeviceCaps
CreatePalette
CreateEllipticRgn

comdlg32

GetOpenFileNameA

advapi32

GetUserNameA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegDeleteValueW
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoInitializeEx
OleRun
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize

oleaut32

SysStringLen
SysFreeString
VariantClear
GetErrorInfo

psapi

GetModuleFileNameExW
EnumProcesses

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad3aad627a35fcd353271e46b9c297a7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

psapi

Sections

.text Size: 70KB - Virtual size: 70KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 6KB - Virtual size: 147KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 70KB - Virtual size: 70KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 6KB - Virtual size: 147KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 5KB - Virtual size: 5KB