ochibo_dl[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ochibo_dl.exe
Size

479KB
MD5

263a21dcd0954af1dc9a442700cf1750
SHA1

161ca2e672fdb06137d81c4217b152c03bbdf570
SHA256

ca0dcdb2b1eceaaa01c97f8ecc5c6761ae38dcd617efc699f1ae6cab80556682
SHA512

ee5b50988b3a837c73072e3659d0de2477425062b70fff7ec5bbf022d4be9bd6e339dc9e13a888b391af6bdcb8a7d4209b419f1feb78d811d847194024f253e3
SSDEEP

12288:05I0Cd5ofRbCaqo5GSoZzSUDZiWt6BN3BHnhBB8kZhr:5dGRbCaqGGxBSUDvt6HBBBBLZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ochibo_dl.exe

Files

ochibo_dl.exe
.exe windows x86

25c8fc6f262110e86bde33df4f164aa1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
CreateSemaphoreA
GetLastError
LoadLibraryExA
OutputDebugStringA
SetCurrentDirectoryA
Sleep
FileTimeToSystemTime
CopyFileA
MoveFileA
GetFileTime
FileTimeToLocalFileTime
GetLocalTime
LocalAlloc
FindNextFileA
FindClose
FindFirstFileA
GetModuleHandleA
RtlUnwind
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
FreeLibrary
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
RaiseException
HeapReAlloc
WriteFile
lstrlenA
SetFilePointer
GetModuleFileNameA
VirtualAlloc
EnterCriticalSection
GetFileSize
CreateFileA
CloseHandle
HeapSize
ReadFile
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
GetLogicalDrives
GetDriveTypeA
GetVolumeInformationA
CreateDirectoryA
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate

user32

GetWindowTextA
WINNLSEnableIME
MoveWindow
SetRect
LoadStringA
DestroyWindow
PostQuitMessage
LoadIconA
SetFocus
SendMessageA
IsDialogMessageA
MessageBeep
MessageBoxA
UnregisterClassA
GetWindowLongA
CreateWindowExA
PeekMessageA
GetDlgItem
ShowWindow
GetActiveWindow
DispatchMessageA
DefDlgProcA
SetWindowTextA
UpdateWindow
LoadCursorA
RegisterClassA
wsprintfA
TranslateMessage

gdi32

GetStockObject
DeleteObject
CreateFontIndirectA

shell32

ShellExecuteA
SHGetPathFromIDListA

imm32

ImmReleaseContext
ImmSetOpenStatus
ImmSetConversionStatus
ImmGetContext

winmm

timeGetTime

shlwapi

PathFileExistsA
PathIsDirectoryA
PathRenameExtensionA
PathRemoveFileSpecA

Sections

.text
Size: 206KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25c8fc6f262110e86bde33df4f164aa1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

imm32

winmm

shlwapi

Sections

.text Size: 206KB - Virtual size: 206KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 9KB - Virtual size: 13KB

.rsrc Size: 209KB - Virtual size: 208KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 206KB - Virtual size: 206KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 9KB - Virtual size: 13KB

.rsrc
Size: 209KB - Virtual size: 208KB

.reloc
Size: 13KB - Virtual size: 13KB