e281849ce181fd5bd03e031a203d0a76a1ce54a39396c898182210c07fcf3074

Sharing

Copy URL Twitter E-mail

General

Target

e281849ce181fd5bd03e031a203d0a76a1ce54a39396c898182210c07fcf3074
Size

943KB
MD5

c6289d5ca4a52ec66b5a222d7dec08ba
SHA1

649a79d604415d62004c523e530ff61b7619fa2a
SHA256

e281849ce181fd5bd03e031a203d0a76a1ce54a39396c898182210c07fcf3074
SHA512

828eec752524546bdd7ca4346f17e75f33fa31ef0f8ac1eee46c22ebb9125776709bb70e4833e35bad12b2bd486e33f80b079787a12ef997e668cb0e1e9cacba
SSDEEP

24576:J3Cv+A1bWByJ09ta3ycEWSP/tGcN39IPX9Z8:BXA96tDW5f9C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e281849ce181fd5bd03e031a203d0a76a1ce54a39396c898182210c07fcf3074

Files

e281849ce181fd5bd03e031a203d0a76a1ce54a39396c898182210c07fcf3074
.exe windows x86

3c616f54e9945d3eb41cb2f2ac6d6bc3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

CommandLineToArgvW

kernel32

CreateFileW
LockResource
LoadResource
FindResourceW
GetTempPathW
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
HeapFree
GetCurrentProcess
HeapAlloc
GetProcessHeap
WriteFile
FindClose
CreateEventW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SizeofResource
GetModuleHandleW
CreateProcessW
VirtualAllocEx
GetProcAddress
QueueUserAPC
CloseHandle
ResumeThread
GetModuleFileNameW
TerminateProcess
ExpandEnvironmentStringsW
WriteProcessMemory
GetCommandLineW
FlushFileBuffers
SetStdHandle
FindFirstFileExA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
HeapSize
EnterCriticalSection
LeaveCriticalSection
EncodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
OutputDebugStringW
InterlockedPushEntrySList
RtlUnwind
FreeLibrary
LoadLibraryExW
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetACP
GetFileType
FindNextFileA

shlwapi

SHGetValueW
SHSetValueW

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

Sections

.text
Size: 233KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69.4MB - Virtual size: 69.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c616f54e9945d3eb41cb2f2ac6d6bc3

Headers

DLL Characteristics

File Characteristics

Imports

shell32

kernel32

shlwapi

rpcrt4

Sections

.text Size: 233KB - Virtual size: 232KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 8KB - Virtual size: 17KB

.gfids Size: 512B - Virtual size: 444B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 69.4MB - Virtual size: 69.4MB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 233KB - Virtual size: 232KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 8KB - Virtual size: 17KB

.gfids
Size: 512B - Virtual size: 444B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 69.4MB - Virtual size: 69.4MB

.reloc
Size: 17KB - Virtual size: 17KB