1c852f480ffc761bcfc923b69902b048a71004ba856cbe73e9c49ff1d047fa8f

Sharing

Copy URL Twitter E-mail

General

Target

1c852f480ffc761bcfc923b69902b048a71004ba856cbe73e9c49ff1d047fa8f
Size

865KB
MD5

f4e2c7ad7864b79e9ff3ab359dcbba3e
SHA1

242a2e6794a505f5874651fccd813efff109e717
SHA256

1c852f480ffc761bcfc923b69902b048a71004ba856cbe73e9c49ff1d047fa8f
SHA512

6d0ad3fa93adf3daa92fc3bde65fad22a926f1c3a3c7d16d2bdba9c9f0b1a98720175fb0cc0dce4d27d315c6484e26a69afdba1329f805acdd47930af51cc773
SSDEEP

12288:IZPG4tZ7jx981hRTbGQqzOGuY0DhgTPUAGvCJ+VjR/isHnasCModiVWG/bxnIO4b:CljHMh5bhguzv5IvLiw8bxm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c852f480ffc761bcfc923b69902b048a71004ba856cbe73e9c49ff1d047fa8f

Files

1c852f480ffc761bcfc923b69902b048a71004ba856cbe73e9c49ff1d047fa8f
.exe windows x86

6d2522b758339632c7bea9eba60fac9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
SizeofResource
GetExitCodeProcess
TerminateProcess
GetSystemDirectoryA
GetLastError
GetProcAddress
Process32Next
LockResource
GetModuleFileNameA
CreateToolhelp32Snapshot
CloseHandle
GetTempPathA
WriteFile
GetTickCount
InitializeCriticalSection
CreateFileW
WriteConsoleW
SetStdHandle
RtlUnwind
GetWindowsDirectoryA
WaitForSingleObject
Process32First
LoadResource
FindResourceA
CreateFileA
LoadLibraryW
HeapAlloc
HeapReAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
GetModuleFileNameW
HeapCreate
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
IsProcessorFeaturePresent
Sleep
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
RaiseException
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
InterlockedExchange

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegCreateKeyA

shell32

ShellExecuteA

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d2522b758339632c7bea9eba60fac9e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

Sections

.text Size: 55KB - Virtual size: 54KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 6KB - Virtual size: 15KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 55KB - Virtual size: 54KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 6KB - Virtual size: 15KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 17KB - Virtual size: 16KB