e1b3f22e4f103fdb40ef2eb390997f20001818c5e325c60a49ba090713a92b45

Sharing

Copy URL Twitter E-mail

General

Target

e1b3f22e4f103fdb40ef2eb390997f20001818c5e325c60a49ba090713a92b45
Size

1.2MB
MD5

bd3a09f1951b05cf2bbc40fbe598141f
SHA1

1b846b9913b7ee31c95ccf4c6fe60a7df3390e37
SHA256

e1b3f22e4f103fdb40ef2eb390997f20001818c5e325c60a49ba090713a92b45
SHA512

be586f2159bc4da6d3dd4d68ba5308943a7eb1f94511fc0bebaf5155c6f4c3bdec5f9d2e313996b5607eb351c2b4a5e739b9c14706c84d9dfd86e1a0caab9716
SSDEEP

12288:Oh/vHdDeHLS6TutjZa8AnmUMg4m2A4uHhPP9cOSYxHN+TG8hPP9cOSYxHN+TDt:A/vHdiHLvuTAnmKp9fbH/S9fbHKt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1b3f22e4f103fdb40ef2eb390997f20001818c5e325c60a49ba090713a92b45

Files

e1b3f22e4f103fdb40ef2eb390997f20001818c5e325c60a49ba090713a92b45
.exe windows x64

81db61a7f98e5e7821dd8a3ad1a50d8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WinExec
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
CloseHandle
SetEndOfFile
VirtualQuery
GetProcessHeap
CreateFileW
CreateFileA
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
GetLastError
lstrlenA
LocalFree
HeapSize
HeapValidate
IsBadReadPtr
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleFileNameW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineA
LCMapStringW
GetCPInfo
InitializeCriticalSectionAndSpinCount
HeapAlloc
GetModuleFileNameA
HeapSetInformation
GetVersion
HeapCreate
HeapReAlloc
HeapQueryInformation
HeapFree
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
GetCurrentThreadId
FlsAlloc
FlsFree
SetLastError
GetStdHandle
WriteFile
OutputDebugStringA
WriteConsoleW
GetFileType
OutputDebugStringW
LoadLibraryW
SetHandleCount
GetStartupInfoW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
FreeLibrary
GetLocaleInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
GetLocaleInfoA

advapi32

GetLengthSid
SetTokenInformation
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

ole32

CoInitializeSecurity
CoInitializeEx
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Sections

.text
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 887KB - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81db61a7f98e5e7821dd8a3ad1a50d8a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 264KB - Virtual size: 264KB

.rdata Size: 72KB - Virtual size: 72KB

.data Size: 887KB - Virtual size: 897KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 264KB - Virtual size: 264KB

.rdata
Size: 72KB - Virtual size: 72KB

.data
Size: 887KB - Virtual size: 897KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 5KB - Virtual size: 4KB