9fc77a347dec27a80bda3a4bc14ba69a2ddfaf2c36824e177e8624826e552cdc

Sharing

Copy URL Twitter E-mail

General

Target

9fc77a347dec27a80bda3a4bc14ba69a2ddfaf2c36824e177e8624826e552cdc
Size

2.6MB
MD5

920134c19b1fc426d5cf000e00a72d2a
SHA1

6922307f4cea34d5fdb0c668e4b0bc56e5d60a21
SHA256

9fc77a347dec27a80bda3a4bc14ba69a2ddfaf2c36824e177e8624826e552cdc
SHA512

ba8ad5e8e08e80b78c9c0df0e29b33fb81476a546b9a048923de6a2100a3d52d1f6202ba754a2fa16645ad1a0900c9059ce453d7af93e627bfa4124e5a02b918
SSDEEP

49152:PSP6VKKYvv+MX+5XXvmU94wnXNDsxkWsi+7m8G+ATTzpFNWY6/xdMYKSEktY8:KPYKKPxvmU94eDgRsF7HUp6/xdM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9fc77a347dec27a80bda3a4bc14ba69a2ddfaf2c36824e177e8624826e552cdc

Files

9fc77a347dec27a80bda3a4bc14ba69a2ddfaf2c36824e177e8624826e552cdc
.exe windows x86

4937c9906d75c5c8c593627fa7e8a2be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
SetLastError
InterlockedDecrement
GetModuleHandleA
OpenProcess
GetExitCodeProcess
GetCurrentProcess
GetDriveTypeA
GetComputerNameA
GetComputerNameExA
GetModuleFileNameA
QueryPerformanceFrequency
GetFileInformationByHandle
GetFileAttributesExA
InitializeCriticalSection
RemoveDirectoryA
CreateToolhelp32Snapshot
Process32First
Process32Next
HeapCreate
CreateProcessA
TerminateProcess
CreateThread
GetExitCodeThread
ResumeThread
SetErrorMode
ExitThread
WriteFile
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
UnlockFileEx
GetTickCount
OutputDebugStringW
WaitForSingleObjectEx
LockFile
UnlockFile
InterlockedCompareExchange
WaitForSingleObject
HeapFree
QueryPerformanceCounter
SetConsoleMode
ReadConsoleInputA
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
FreeLibrary
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
CreateMutexW
GetFileAttributesA
LeaveCriticalSection
HeapDestroy
FormatMessageW
Sleep
LoadLibraryW
AllocConsole
ResetEvent
SetEvent
CreateEventA
WaitForMultipleObjects
PeekNamedPipe
VerSetConditionMask
VerifyVersionInfoA
SleepEx
MoveFileA
FlushConsoleInputBuffer
GlobalMemoryStatus
GetVersion
SetEnvironmentVariableA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
GetConsoleOutputCP
WideCharToMultiByte
WriteConsoleA
SetStdHandle
GetStringTypeA
GetStartupInfoA
GetFileType
SetHandleCount
VirtualAlloc
VirtualFree
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
FindClose
FindNextFileA
GetCurrentDirectoryA
FindFirstFileA
IsValidCodePage
GetOEMCP
GetACP
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetStdHandle
GetCurrentThreadId
TlsFree
TlsSetValue
InterlockedIncrement
InterlockedExchange
GetLocaleInfoA
GetModuleHandleW
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetTimeFormatA
GetDateFormatA
GetConsoleCP
GetConsoleMode
FileTimeToSystemTime
FileTimeToLocalFileTime
GetTimeZoneInformation
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
GetStringTypeW
TlsGetValue
TlsAlloc

user32

MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegSetValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathA

oleaut32

VariantClear

ws2_32

getaddrinfo
gethostbyname
send
getsockopt
listen
accept
closesocket
__WSAFDIsSet
socket
recv
WSACleanup
sendto
setsockopt
shutdown
ntohs
WSAGetLastError
select
htonl
inet_addr
ntohl
recvfrom
WSAStartup
connect
ioctlsocket
getsockname
inet_ntoa
gethostname
WSASetLastError
WSAIoctl
getpeername
freeaddrinfo
bind
htons

shlwapi

PathCombineA

iphlpapi

GetAdaptersInfo

wldap32

ord46
ord41
ord211
ord22
ord27
ord301
ord33
ord35
ord143
ord32
ord79
ord30
ord26
ord50
ord60
ord200

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 445KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4937c9906d75c5c8c593627fa7e8a2be

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

ws2_32

shlwapi

iphlpapi

wldap32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 445KB - Virtual size: 444KB

.data Size: 55KB - Virtual size: 72KB

.rsrc Size: 99KB - Virtual size: 98KB

.reloc Size: 104KB - Virtual size: 103KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 445KB - Virtual size: 444KB

.data
Size: 55KB - Virtual size: 72KB

.rsrc
Size: 99KB - Virtual size: 98KB

.reloc
Size: 104KB - Virtual size: 103KB