something[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

something.exe
Size

608KB
MD5

a982de00a26964ab1f4efde9e118917e
SHA1

ed8077d071d2a34a26f7a3b1b6fa6745702642b6
SHA256

6171e06fd045af08fdbe8f9cca96a57a01f64188f2c3d50498e71e0de7ab24f1
SHA512

1707b80aa63219826e567f7b07e18f99a80e7193ce47fb3407d554d5f9d9bc050da3ac64e0061a331a03df7a5c21d585b76982b3ffcd4f91bae2ebf74caf1ba5
SSDEEP

6144:no+fyse8bRrMwwl29PvIMtuukYmiZo5E2wgCCicsKBxjC/NMYtj2f1aIrtRoCVbO:v9ZRrf6YxHZPo29tjk1NXom

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
something.exe

Files

something.exe
.exe windows x86

1d0ffa7bb9e2603ee2dcd868551f806f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
ReadFile
WideCharToMultiByte
GetLastError
GetCurrentProcess
MulDiv
lstrlenW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
InterlockedIncrement
MultiByteToWideChar
ExitProcess
GetProcessHeap
HeapDestroy
IsBadWritePtr
WaitForSingleObject
SetUnhandledExceptionFilter
GetModuleHandleW
VirtualQuery
HeapCreate
OutputDebugStringA
GetTickCount
CloseHandle
CreateEventW
HeapFree
HeapAlloc
FlushFileBuffers
LCMapStringEx
GetCommandLineA
IsProcessorFeaturePresent
SetLastError
InterlockedDecrement
GetCurrentThreadId
IsDebuggerPresent
EncodePointer
DecodePointer
GetModuleHandleExW
GetProcAddress
GetStdHandle
WriteFile
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
RtlUnwind
HeapReAlloc
GetStringTypeW
HeapSize
WriteConsoleW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

user32

GetSystemMetrics
GetDC
ReleaseDC

gdi32

DeleteObject
ExtSelectClipRgn
SetStretchBltMode
MoveToEx
CreateCompatibleDC
SelectObject
ExtTextOutW
SelectClipRgn
StretchBlt
CreateDIBSection
TextOutW
CreateCompatibleBitmap
DeleteDC
GetDeviceCaps
GdiFlush
LineTo
BitBlt

msimg32

GradientFill

winmm

PlaySoundW
waveOutGetVolume
waveOutOpen
waveOutClose

Sections

.text
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d0ffa7bb9e2603ee2dcd868551f806f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

gdi32

msimg32

winmm

Sections

.text Size: 448KB - Virtual size: 448KB

.rdata Size: 128KB - Virtual size: 128KB

.data Size: 11KB - Virtual size: 11KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 448KB - Virtual size: 448KB

.rdata
Size: 128KB - Virtual size: 128KB

.data
Size: 11KB - Virtual size: 11KB

.reloc
Size: 4KB - Virtual size: 4KB