5799c5f7ca72c205fd5690d8a3602605cafeaad7ed5753c8090ffb4fabc4d6a4

Sharing

Copy URL Twitter E-mail

General

Target

5799c5f7ca72c205fd5690d8a3602605cafeaad7ed5753c8090ffb4fabc4d6a4
Size

241KB
MD5

5408a4705a7ecf4ed8370ac0c1128d37
SHA1

783fa2b9a6e204f4c0cace22d1c74260b09c800a
SHA256

5799c5f7ca72c205fd5690d8a3602605cafeaad7ed5753c8090ffb4fabc4d6a4
SHA512

42f06d12492fc117aafc7473b4893df29b65c4972dd1c1dd7a98689c7319aa08aa52a16f5ffe325730a747606feab08f7cb1ed963d2dff2009078283be664cca
SSDEEP

1536:FvHYPPibvHhJw3RugEJ50GnrlkC1ViM8E7l9FCHnTiCbiN:FvHYPSLaRS8Gnrlkbo7l94HnTiGi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5799c5f7ca72c205fd5690d8a3602605cafeaad7ed5753c8090ffb4fabc4d6a4

Files

5799c5f7ca72c205fd5690d8a3602605cafeaad7ed5753c8090ffb4fabc4d6a4
.exe windows x86

f1aa3acffb08497ea6afd0b086922209

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetPrivateProfileIntW
GetFileAttributesW
GetLastError
FindNextFileW
FindClose
FindFirstFileW
HeapFree
GetStringTypeA
HeapAlloc
FlushFileBuffers
SetEnvironmentVariableA
CompareStringW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
CompareStringA
GetOEMCP
GetACP
GetCPInfo
SetStdHandle
LoadLibraryA
GetProcAddress
IsBadCodePtr
WriteFile
CloseHandle
GetModuleFileNameW
IsBadReadPtr
SetUnhandledExceptionFilter
RtlUnwind
GetVersion
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
GetFileAttributesA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetModuleFileNameA
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStringTypeW

user32

SendMessageW
IsDlgButtonChecked
FindWindowW
MessageBoxW

advapi32

CryptAcquireContextW
CryptReleaseContext

wintrust

CryptCATEnumerateMember
CryptCATPersistStore
CryptCATPutMemberInfo
CryptCATGetMemberInfo
CryptCATClose
CryptCATAdminCalcHashFromFileHandle
CryptCATOpen

crypt32

CryptSIPRetrieveSubjectGuid
CryptSIPLoad
CertAlgIdToOID

shlwapi

StrRChrW

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

jqsocug
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f1aa3acffb08497ea6afd0b086922209

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wintrust

crypt32

shlwapi

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 28KB - Virtual size: 28KB

jqsocug Size: - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 28KB

jqsocug
Size: - Virtual size: 4KB