f9193ca0c561f7175f646a25310de2d25e8c5a3f8eefa52d7872ec6865efb5a4

Sharing

Copy URL Twitter E-mail

General

Target

f9193ca0c561f7175f646a25310de2d25e8c5a3f8eefa52d7872ec6865efb5a4
Size

276KB
MD5

6cdb297b0b5867f177bbcdc3843606fa
SHA1

c1f785314c3b2cf83c265ba221d9f2a9123c23f1
SHA256

f9193ca0c561f7175f646a25310de2d25e8c5a3f8eefa52d7872ec6865efb5a4
SHA512

e4449a27f4888f6b14f6a62158508af78e0e069e9f017cc778c35cb301323d5ac810517e576b084f401eb57b89d1ae784470c9180569316c964b357a6eb00573
SSDEEP

3072:aVC7qNAiaek5iyNO3ttuEpqFh5QR1EcxaC1nBMm/l8eiOl0LVzGDHTmpyogTa:aAqHajnOtYhha1yC1BMQl89a0BBpua

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9193ca0c561f7175f646a25310de2d25e8c5a3f8eefa52d7872ec6865efb5a4

Files

f9193ca0c561f7175f646a25310de2d25e8c5a3f8eefa52d7872ec6865efb5a4
.exe windows x86

4063f17288e809abdc5566d96ff3416a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
GetStdHandle
AllocConsole
ReadConsoleA
ReadFile
SetHandleInformation
CreatePipe
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
OpenProcess
GetCurrentProcessId
GetDriveTypeA
GetModuleFileNameA
GetCurrentProcess
FindClose
FindNextFileA
FindFirstFileA
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateThread
WaitForSingleObject
CreateSemaphoreA
InitializeCriticalSection
HeapDestroy
GetStartupInfoA
CreateProcessA
CloseHandle
LoadLibraryA
FreeLibrary
GetProcAddress
GetTickCount
GetLogicalDriveStringsA
Sleep
GetStringTypeExA
GetSystemInfo
VirtualQuery
VirtualProtect
SetEnvironmentVariableA
SetEndOfFile
GetLocaleInfoW
CreateFileA
GetOEMCP
GetACP
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
GetFileType
IsValidCodePage
IsValidLocale
IsBadWritePtr
VirtualAlloc
VirtualFree
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
RaiseException
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
TerminateProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
SetUnhandledExceptionFilter
GetModuleHandleA
HeapSize
SetFilePointer
FlushFileBuffers
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
HeapCreate

user32

LoadStringA

advapi32

DuplicateToken
MapGenericMask
AccessCheck
OpenProcessToken
GetTokenInformation
LookupAccountSidA
GetFileSecurityA

ws2_32

sendto
recvfrom
gethostname
gethostbyname
htons
ioctlsocket
connect
select
send
setsockopt
recv
closesocket
inet_ntoa
WSAStartup
inet_addr
WSACleanup
socket

wininet

InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
InternetSetOptionA
HttpSendRequestA
InternetCloseHandle
InternetQueryOptionA

mpr

WNetAddConnection2A

Sections

.text
Size: 224KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4063f17288e809abdc5566d96ff3416a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

wininet

mpr

Sections

.text Size: 224KB - Virtual size: 221KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 192B

.text
Size: 224KB - Virtual size: 221KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 192B