af7022d1799bf91f85652a469729b52f58ab08820aba66ef2e6fd40233f8e75b

Sharing

Copy URL Twitter E-mail

General

Target

af7022d1799bf91f85652a469729b52f58ab08820aba66ef2e6fd40233f8e75b
Size

2.0MB
MD5

f1b8f3c366f085c5f31bae1a0a65592d
SHA1

296d77c774fe610b9b1323a8b670a9002cd9a090
SHA256

af7022d1799bf91f85652a469729b52f58ab08820aba66ef2e6fd40233f8e75b
SHA512

a8deae5ac9d2b3bdfcaf733d90ca0e23a2ad85d5bcdeb0725a721164678aae7d317bf47e8990052238e0f0ae443d8294f22a98e0f9feeb63966e8b7cc0c7b049
SSDEEP

24576:ApwVibt/lAnm19fbHiGNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eK9mCy3KxW3ixPEmx7:ApwUttdGlxapGInW3Rm2vGaCJQ7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af7022d1799bf91f85652a469729b52f58ab08820aba66ef2e6fd40233f8e75b

Files

af7022d1799bf91f85652a469729b52f58ab08820aba66ef2e6fd40233f8e75b
.exe windows x64

81db61a7f98e5e7821dd8a3ad1a50d8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WinExec
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
CloseHandle
SetEndOfFile
VirtualQuery
GetProcessHeap
CreateFileW
CreateFileA
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
GetLastError
lstrlenA
LocalFree
HeapSize
HeapValidate
IsBadReadPtr
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleFileNameW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineA
LCMapStringW
GetCPInfo
InitializeCriticalSectionAndSpinCount
HeapAlloc
GetModuleFileNameA
HeapSetInformation
GetVersion
HeapCreate
HeapReAlloc
HeapQueryInformation
HeapFree
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
GetCurrentThreadId
FlsAlloc
FlsFree
SetLastError
GetStdHandle
WriteFile
OutputDebugStringA
WriteConsoleW
GetFileType
OutputDebugStringW
LoadLibraryW
SetHandleCount
GetStartupInfoW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
FreeLibrary
GetLocaleInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
GetLocaleInfoA

advapi32

GetLengthSid
SetTokenInformation
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

ole32

CoInitializeSecurity
CoInitializeEx
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Sections

.text
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81db61a7f98e5e7821dd8a3ad1a50d8a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 254KB - Virtual size: 254KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 1.7MB - Virtual size: 1.7MB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 47KB - Virtual size: 47KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 254KB - Virtual size: 254KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 1.7MB - Virtual size: 1.7MB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 47KB - Virtual size: 47KB

.reloc
Size: 6KB - Virtual size: 6KB