db863143b74b87d5e92532b754e31d5623684f1f363f9ccb9a2e9995d83d1246

Sharing

Copy URL Twitter E-mail

General

Target

db863143b74b87d5e92532b754e31d5623684f1f363f9ccb9a2e9995d83d1246
Size

17KB
MD5

373b435b4eccde9f095a89d8bcff3bd9
SHA1

5c551b656f64ace069316dcbf0cb4902385800a3
SHA256

db863143b74b87d5e92532b754e31d5623684f1f363f9ccb9a2e9995d83d1246
SHA512

fd4c9306fdf507a8b7c5c87307022c30e7a926b2f922abe3e782936b5df02caec724bb4f3a8a86cefa7c775db901d6eb97dfe28767128f803484f5305d66132a
SSDEEP

384:KBvsGRiT4KCbMqp317Motg7gNPHlECoya4bDq+TWno5WISHn:Kd1LHt8gLE1k91SHn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db863143b74b87d5e92532b754e31d5623684f1f363f9ccb9a2e9995d83d1246

Files

db863143b74b87d5e92532b754e31d5623684f1f363f9ccb9a2e9995d83d1246
.exe windows x86

a06d3c30b2d2a7e65cb59129ce23a1d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken
DeregisterEventSource
ReportEventW
RegCloseKey
RegisterEventSourceW
GetUserNameW

crypt32

CryptProtectData

winspool.drv

SpoolerInit

user32

wsprintfW
CharNextW
LoadStringW
MessageBoxW
LoadRemoteFonts

shell32

ShellExecuteExW

ntdll

NtClose
_chkstk
_wcsicmp
NtOpenKey
DbgPrint
wcscpy
RtlInitUnicodeString
memmove

imm32

ImmDisableIME

userenv

ord175

msvcrt

__set_app_type
_controlfp
_except_handler3
__p__fmode
_adjust_fdiv
__setusermatherr
_initterm
exit
_XcptFilter
_exit
_acmdln
__getmainargs
__p__commode

kernel32

GetCurrentProcessId
SetEvent
GetModuleHandleA
CompareFileTime
GetThreadLocale
GetCurrentThread
SetThreadPriority
CreateThread
TerminateThread
LoadLibraryW
GetProcAddress
FreeLibrary
Sleep
OpenEventW
GetEnvironmentVariableW
SetCurrentDirectoryW
GetPrivateProfileStringW
GetFileAttributesExW
GetCurrentProcess
GetLastError
FormatMessageW
SetEnvironmentVariableW
lstrcatW
lstrcmpiW
GetSystemDirectoryW
GetStartupInfoA
SearchPathW
ExpandEnvironmentStringsW
LocalAlloc
LocalFree
CreateProcessW
lstrlenW
lstrcpyW
WaitForSingleObject
CloseHandle

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a06d3c30b2d2a7e65cb59129ce23a1d9

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

winspool.drv

user32

shell32

ntdll

imm32

userenv

msvcrt

kernel32

Sections

.text Size: 12KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 280B

.rsrc Size: 3KB - Virtual size: 4KB

.text
Size: 12KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 280B

.rsrc
Size: 3KB - Virtual size: 4KB