94b63fe550940b7f7fe9a1e5c22811eeaa5536d0dab91cb3e4a7351d68bf5181

Sharing

Copy URL Twitter E-mail

General

Target

94b63fe550940b7f7fe9a1e5c22811eeaa5536d0dab91cb3e4a7351d68bf5181
Size

438KB
MD5

6214a7ac95e57ba5e70b2c2e78bbe7f5
SHA1

fa2c53c27af8ffca7cdd22ca9ca4a6c7514f22cd
SHA256

94b63fe550940b7f7fe9a1e5c22811eeaa5536d0dab91cb3e4a7351d68bf5181
SHA512

4c4e25bbbe95f11b510c3263ba71cd47bf04d26546464442259f14ad54d1423a5399638201b10436ddecc0c55faa726d9a7414d399db89d1a2499a91db21df22
SSDEEP

6144:yFHnuBa28c5inM1B611mF/p/uwONct43j92U9lNb9p/+:6HuBocyM1B99pGHNu4B2U9lLN+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94b63fe550940b7f7fe9a1e5c22811eeaa5536d0dab91cb3e4a7351d68bf5181

Files

94b63fe550940b7f7fe9a1e5c22811eeaa5536d0dab91cb3e4a7351d68bf5181
.exe windows x86

b38aa10e891c53d555dbdedb95c09066

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc140d

ord3085
ord5381
ord10548
ord11093
ord9815
ord10950
ord13634
ord6455
ord4473
ord5488
ord10975
ord13955
ord13317
ord12154
ord3773
ord9176
ord2962
ord5072
ord10062
ord4585
ord13636
ord7213
ord4463
ord8636
ord605
ord2408
ord12624
ord14434
ord14520
ord6786
ord6785
ord13642
ord17184
ord9954
ord16997
ord13486
ord8460
ord12945
ord13484
ord13485
ord8461
ord6554
ord14059
ord2041
ord13254
ord13982
ord16382
ord1301
ord2047
ord16381
ord1055
ord1571
ord1646
ord8953
ord2512
ord2522
ord4184
ord2771
ord1643
ord9836
ord2556
ord2656
ord14390
ord371
ord10045
ord6065
ord1170
ord4837
ord963
ord1512
ord580
ord3764
ord4506
ord2056
ord1282
ord618
ord10094
ord8233
ord8404
ord1308
ord10946
ord8234
ord8398
ord7544
ord16075
ord5826
ord4586
ord13999
ord7186
ord15975
ord16531
ord9322
ord6208
ord15110
ord15111
ord17019
ord9661
ord15749
ord6880
ord16961
ord10994
ord3086
ord5382
ord4467
ord13963
ord3024
ord5145
ord9816
ord2607
ord2680
ord3846
ord15854
ord15914
ord9622
ord5494
ord15170
ord9441
ord2613
ord14018
ord5376
ord14017
ord5501
ord13551
ord9813
ord9841
ord5963
ord15839
ord6232
ord6231
ord851
ord9760
ord9862
ord9979
ord6364
ord6538
ord6533
ord3261
ord16604
ord7612
ord10532
ord16529
ord3711
ord12898
ord3934
ord13142
ord5855
ord5845
ord5909
ord5879
ord5931
ord5946
ord5891
ord5885
ord5940
ord5897
ord5903
ord5956
ord5917
ord5870
ord2024
ord1997
ord1983
ord17035
ord4768
ord13358
ord2404
ord6043
ord6048
ord9953
ord3713
ord7581
ord15324
ord14023
ord4688
ord4673
ord5725
ord10521
ord16739
ord9726
ord3900
ord15668
ord12972
ord10731
ord10684
ord16886
ord3812
ord3951
ord14453
ord3153
ord2452
ord12940
ord3239
ord3640
ord13306
ord11031
ord10726
ord14736
ord15676
ord4672
ord5404
ord13084
ord16719
ord10667
ord10689
ord8077
ord808
ord3800
ord3948
ord14903
ord10047
ord10148
ord10050
ord10151
ord15477
ord9600
ord9644
ord14835
ord14711
ord14678
ord7828
ord4450
ord14951
ord7052
ord6994
ord15484
ord6114
ord5262
ord15242
ord10124
ord15078
ord14800
ord3237
ord14955
ord2421
ord9430
ord16837
ord13610
ord14101
ord10563
ord13189
ord12115
ord3381
ord13735
ord13152
ord1420
ord3181
ord3207
ord10819
ord16737
ord10839
ord3191
ord2968
ord5078
ord9599
ord4848
ord4862
ord10683
ord10682
ord10724
ord2023
ord1981
ord5866
ord5851
ord1993
ord2019
ord1971
ord11728
ord11249
ord11254
ord11264
ord4782
ord13550
ord14086
ord10985
ord10584
ord5622
ord2431
ord4945
ord3923
ord11123
ord5245
ord10752
ord2317
ord16579
ord3194
ord10665
ord15053
ord10091
ord16665
ord7315
ord8571
ord7900
ord500
ord1223
ord3748
ord3936
ord14053
ord3749
ord13594
ord9761
ord6152
ord10723
ord10666
ord3169
ord9415
ord10112
ord15065
ord9826
ord3220
ord9981
ord16662
ord16796
ord4699
ord9724
ord6535
ord3067
ord4250
ord4704
ord4705
ord4690
ord16885
ord16922
ord16605
ord5273
ord15401
ord3230
ord15226
ord3712
ord10729
ord3638
ord11040
ord11017
ord13194
ord4670
ord11410
ord10681
ord5402
ord16717
ord16724
ord12939
ord4849
ord2435
ord13565
ord16702
ord15494
ord3311
ord3337
ord13423
ord694
ord8756
ord832
ord1434
ord13846
ord3696
ord15248
ord11317
ord10765
ord10886
ord10831
ord3986
ord4029
ord10791
ord11495
ord10728
ord15031
ord16203
ord14905
ord3575
ord15315
ord16386
ord2971
ord5081
ord8639
ord2795
ord10310
ord10363
ord10370
ord10295
ord10373
ord10378
ord10374
ord10237
ord3765
ord6299
ord1994
ord8115
ord1470
ord1655
ord878
ord2975
ord5085
ord2618
ord1880
ord322
ord1141
ord10140
ord9945
ord5392
ord17062
ord14376
ord17115
ord6479
ord1835
ord1823
ord3818
ord5789
ord10483
ord16538
ord10692
ord7190
ord13285
ord2039
ord7212
ord3864
ord2963
ord5073
ord7189
ord4475
ord5976
ord15983
ord15981
ord4464
ord1089
ord1598
ord829
ord1433
ord10029
ord8767
ord15626
ord16494
ord2370
ord15422
ord5248
ord804
ord3798
ord15861
ord1416
ord684
ord1354
ord15662
ord5316
ord9563
ord9231
ord2117
ord609
ord608
ord4683
ord2409
ord5260
ord5222
ord12625
ord14435
ord13315
ord5360
ord16644
ord5288
ord3631
ord16765
ord16975
ord13238
ord14061
ord10064
ord17048
ord10954
ord11095
ord10978
ord13984
ord9315
ord9451
ord13332
ord10942
ord11464
ord13638
ord13255
ord13326
ord10550
ord2399
ord10093
ord15043
ord3917
ord4041
ord1303
ord6939
ord11047
ord13523
ord839
ord5353
ord6953
ord17116
ord8770
ord8773
ord8768
ord8771
ord8772
ord8769
ord16345
ord8774
ord2471
ord10369
ord10208

kernel32

OutputDebugStringW
FreeLibrary
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
WideCharToMultiByte
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
CloseHandle
GetCurrentThreadId
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
MultiByteToWideChar
SetLastError
GetLastError
LocalFree

user32

PostQuitMessage
IsChild
GetFocus
EnableWindow
GetSysColor
SetRectEmpty
InflateRect
GetSystemMetrics
LoadImageA
UnregisterClassA
PeekMessageA

gdi32

DeleteObject
GetStockObject
DeleteDC

comctl32

InitCommonControlsEx

oleaut32

VariantChangeType
SetErrorInfo
CreateErrorInfo
SysFreeString
VariantClear
VariantInit
GetErrorInfo
SysAllocString

gdiplus

GdiplusShutdown

vcruntime140d

__CxxFrameHandler3
memset
_purecall
__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
memmove
_CxxThrowException

ucrtbased

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
__setusermatherr
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_seh_filter_dll
_set_fmode
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
terminate
strcat_s
__stdio_common_vsprintf_s
_controlfp_s
_wmakepath_s
_wsplitpath_s
_invalid_parameter_noinfo
_errno
_recalloc
strlen
_exit
_CrtDbgReportW
_CrtDbgReport
malloc
free
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf_s
wcslen
wcscpy_s
_setmbcp
strcpy_s

Sections

.textbss
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b38aa10e891c53d555dbdedb95c09066

Headers

DLL Characteristics

File Characteristics

Imports

mfc140d

kernel32

user32

gdi32

comctl32

oleaut32

gdiplus

vcruntime140d

ucrtbased

Sections

.textbss Size: - Virtual size: 76KB

.text Size: 195KB - Virtual size: 194KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 3KB - Virtual size: 14KB

.idata Size: 13KB - Virtual size: 12KB

.msvcjmc Size: 1KB - Virtual size: 1KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 148KB - Virtual size: 148KB

.reloc Size: 18KB - Virtual size: 18KB

.textbss
Size: - Virtual size: 76KB

.text
Size: 195KB - Virtual size: 194KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 3KB - Virtual size: 14KB

.idata
Size: 13KB - Virtual size: 12KB

.msvcjmc
Size: 1KB - Virtual size: 1KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 148KB - Virtual size: 148KB

.reloc
Size: 18KB - Virtual size: 18KB