SecuriteInfo[.]com[.]Variant[.]Razy[.]921254[.]19666[.]846 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Variant.Razy.921254.19666.846
Size

15KB
MD5

612934573cfd4614369ec85a23dcc0ec
SHA1

7c3e9484f66496b1e67bfdb38e20064dcd0f1791
SHA256

b9efa23dabf1bdff085a3340fd11bbe78199678ca649fc8aabafd2fd27ed0dd4
SHA512

163da0bef747620c5f6c3fc06f76ae79e2c9c9759dcdce9882824bf621ac7c29856849de907e5b7e022bf1fc1bd172f5625fd817808ae05a56f49cefe89ed829
SSDEEP

192:XSrOtYAG31HSt9F7BWALVtZJFKIS/Oc17Y/H0JH08lYH0yH08lg0GH08l:XSGYAG9St37T/ZTS/V17Y/CvYNvqv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Variant.Razy.921254.19666.846

Files

SecuriteInfo.com.Variant.Razy.921254.19666.846
.exe windows x86

cf40cb9a5bbc1733822d364b22182af8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHRegEnumUSKeyW
UrlUnescapeW
PathRemoveBlanksA
StrCSpnIA
PathAddBackslashA
PathIsUNCA

kernel32

VirtualProtect

wininet

SetUrlCacheEntryGroup
FindCloseUrlCache
FtpRemoveDirectoryW

wsock32

send
WSACancelAsyncRequest

oleaut32

BSTR_UserSize
QueryPathOfRegTypeLi
VarDateFromUdateEx
SafeArrayAllocDescriptor

msi

ord57
ord77
ord16
ord90
ord42
ord19
ord98

wsnmp32

ord203
ord602
ord204
ord320
ord102

winmm

waveInClose
waveInGetDevCapsA
auxSetVolume
PlaySoundA

user32

GetDC
GrayStringA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gty
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ