a1464d56a5e5875be43509bb86c5125d7249c40e3257ef87f1d69e48c145da42

Sharing

Copy URL Twitter E-mail

General

Target

a1464d56a5e5875be43509bb86c5125d7249c40e3257ef87f1d69e48c145da42
Size

5.0MB
MD5

0decc97cfd2c9eb75cea93c81ad3fb62
SHA1

8fadf2d287a53bd91e99f98c2371150edfcaff29
SHA256

a1464d56a5e5875be43509bb86c5125d7249c40e3257ef87f1d69e48c145da42
SHA512

47e4d46fc38325dfd44676e8a94af099b4e2ceeb38e87fe1913ea78aed253176feea2af9933bb0de55c9a13f7a04e96bc532e4bcce366816848aeb587cde1e26
SSDEEP

6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+7:2uWP/BZUyoLu8Agsmxwrvejkd2H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1464d56a5e5875be43509bb86c5125d7249c40e3257ef87f1d69e48c145da42

Files

a1464d56a5e5875be43509bb86c5125d7249c40e3257ef87f1d69e48c145da42
.exe windows x86

eca0c30b65294d02a6c6180a6b323b58

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
HeapSize
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
InterlockedExchange
RtlUnwind
HeapReAlloc
VirtualAlloc
InitializeCriticalSection
LoadLibraryA
GetCPInfo
GetSystemInfo
GetACP
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStdHandle
WriteFile
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
GetLastError
GetCurrentThreadId
SetLastError
TlsAlloc
GetProcAddress
HeapCreate
VirtualQuery
WaitForSingleObject
HeapDestroy
CreateEventW
ExitProcess
WideCharToMultiByte
OutputDebugStringW
CreateFileW
ReadFile
CloseHandle
GetCurrentProcess
MultiByteToWideChar
GetModuleHandleW
InterlockedIncrement
GetModuleFileNameW
lstrlenW
HeapFree
OutputDebugStringA
MulDiv
GetProcessHeap
HeapAlloc
GetOEMCP
GetVersionExA
GetCommandLineA
GetStartupInfoA
GetModuleHandleA

user32

GetClassInfoW
FrameRect
CharUpperBuffW
IsIconic
EnableWindow
DrawIcon
DeleteMenu
SetTimer
CreateAcceleratorTableW
GetSystemMenu
DrawMenuBar
SetMenuItemInfoW
GetWindowTextW
GetDCEx
RegisterClassW
GetMenuItemInfoW
SetScrollPos
FillRect
GetSystemMetrics
GetDC
MsgWaitForMultipleObjectsEx
EndMenu
DestroyCursor
IsZoomed
GetCursor
GetScrollPos
DispatchMessageW
DefFrameProcW
DestroyMenu
ReleaseDC
IsDialogMessageW
GetScrollRange
DefMDIChildProcW
GetMenuStringW
PeekMessageW
CopyImage
ShowCaret
LoadIconW
DrawFocusRect
LoadBitmapW
GetDlgCtrlID
LoadStringW
GetClassInfoExW
DestroyIcon
ShowWindow
EndPaint
PostMessageW
CreateWindowExW
BeginPaint
LoadCursorW
GetClientRect
InsertMenuW
CreateIcon
DestroyWindow
KillTimer
GetScrollInfo
CreateMenu

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

gdi32

Pie
AngleArc
Polygon
CreateSolidBrush
RectVisible
CreateICW
CreatePalette
PolyBezierTo
RoundRect
RestoreDC
GetWindowOrgEx
CreateCompatibleBitmap
MoveToEx
GetTextMetricsW
GetStockObject
SetTextColor
SetAbortProc
SetBkMode
StretchBlt
CreateDCW
GetDeviceCaps
SetRectRgn
GetEnhMetaFileHeader

ole32

OleInitialize
CoUninitialize
OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
IsEqualGUID
CoInitialize
CoCreateInstance

oleaut32

VariantChangeType
SafeArrayPutElement
VariantCopy
VariantClear
SafeArrayGetElement
SafeArrayGetUBound
SysFreeString
GetErrorInfo
VariantInit
SafeArrayPtrOfIndex
SysAllocStringLen
SafeArrayGetLBound
SafeArrayAccessData
VariantCopyInd
SysReAllocStringLen
SafeArrayCreate
SafeArrayUnaccessData

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winspool.drv

EnumPrintersW
ord203
OpenPrinterW
ClosePrinter
DocumentPropertiesW

Sections

.text
Size: 124KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 324KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

eca0c30b65294d02a6c6180a6b323b58

Headers

File Characteristics

Imports

kernel32

user32

advapi32

gdi32

ole32

oleaut32

version

winspool.drv

Sections

.text Size: 124KB - Virtual size: 120KB

.rdata Size: 324KB - Virtual size: 322KB

.data Size: 4KB - Virtual size: 5KB

.text
Size: 124KB - Virtual size: 120KB

.rdata
Size: 324KB - Virtual size: 322KB

.data
Size: 4KB - Virtual size: 5KB