ec84e1f93470328a61c76085e8a30d6cd64e1ad2b418c3c594cded5ebda3ca9a

Sharing

Copy URL Twitter E-mail

General

Target

ec84e1f93470328a61c76085e8a30d6cd64e1ad2b418c3c594cded5ebda3ca9a
Size

241KB
MD5

fceb3206237b7cbab81dd5c9e4b184c1
SHA1

382bc32cf04e223a2ec91a5f55764e4611c1bf53
SHA256

ec84e1f93470328a61c76085e8a30d6cd64e1ad2b418c3c594cded5ebda3ca9a
SHA512

880561171604be2445dfca4cf0707fee762f1d30c2e56a68d99f1f626959fe69d7313205bb1165e5f6ff7dce8e429a3ebdb7e3c1c7802ae295f62ae712053ce0
SSDEEP

1536:svHYPPibvHhJw3RugEJ50Gnrlk6qdaI8RF87ABG:svHYPSLaRS8Gnrlk6qc2R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec84e1f93470328a61c76085e8a30d6cd64e1ad2b418c3c594cded5ebda3ca9a

Files

ec84e1f93470328a61c76085e8a30d6cd64e1ad2b418c3c594cded5ebda3ca9a
.exe windows x86

f1aa3acffb08497ea6afd0b086922209

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetPrivateProfileIntW
GetFileAttributesW
GetLastError
FindNextFileW
FindClose
FindFirstFileW
HeapFree
GetStringTypeA
HeapAlloc
FlushFileBuffers
SetEnvironmentVariableA
CompareStringW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
CompareStringA
GetOEMCP
GetACP
GetCPInfo
SetStdHandle
LoadLibraryA
GetProcAddress
IsBadCodePtr
WriteFile
CloseHandle
GetModuleFileNameW
IsBadReadPtr
SetUnhandledExceptionFilter
RtlUnwind
GetVersion
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
GetFileAttributesA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetModuleFileNameA
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStringTypeW

user32

SendMessageW
IsDlgButtonChecked
FindWindowW
MessageBoxW

advapi32

CryptAcquireContextW
CryptReleaseContext

wintrust

CryptCATEnumerateMember
CryptCATPersistStore
CryptCATPutMemberInfo
CryptCATGetMemberInfo
CryptCATClose
CryptCATAdminCalcHashFromFileHandle
CryptCATOpen

crypt32

CryptSIPRetrieveSubjectGuid
CryptSIPLoad
CertAlgIdToOID

shlwapi

StrRChrW

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

boovttw
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f1aa3acffb08497ea6afd0b086922209

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wintrust

crypt32

shlwapi

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 28KB - Virtual size: 28KB

boovttw Size: - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 28KB

boovttw
Size: - Virtual size: 4KB