3b649741ceae1e6724b6004eeca9cd16def9bba82eb6c80cbed568dac47e5a66

Sharing

Copy URL Twitter E-mail

General

Target

3b649741ceae1e6724b6004eeca9cd16def9bba82eb6c80cbed568dac47e5a66
Size

130KB
MD5

2c4e667c25feab4dfa18d040e91a00f6
SHA1

f6b230e49a2c4a3fe8b9b6e4d1ab80b34d5bc606
SHA256

3b649741ceae1e6724b6004eeca9cd16def9bba82eb6c80cbed568dac47e5a66
SHA512

df31d0939889c9fade3cb8fa8142d3178ae18a110aea82d24e8a734a10bbff448321534e10078503881133ad6a913dd3e51ed105db27724598031d494d3f88d2
SSDEEP

3072:bK1YWhuApQnYxWZqM4x0gxuenYoT5S6x:G15huApoYMZqpx0auen3A6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b649741ceae1e6724b6004eeca9cd16def9bba82eb6c80cbed568dac47e5a66

Files

3b649741ceae1e6724b6004eeca9cd16def9bba82eb6c80cbed568dac47e5a66
.exe windows x86

fb48f360299641b1c7e17a6073a5ead8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
CreateDirectoryW
GetTickCount
VirtualFree
Sleep
FreeConsole
GetConsoleWindow
GetFileAttributesW
GetModuleFileNameW
GetTempPathW
VirtualAlloc
MoveFileW
Process32FirstW
RemoveDirectoryW
Process32NextW
CreateToolhelp32Snapshot
CloseHandle
DeleteFileW
CreateFileW
SetEnvironmentVariableW
CompareStringW
SetStdHandle
WriteConsoleW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalFree
GetLastError
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
RaiseException
RtlUnwind
HeapFree
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetLocaleInfoW
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer

user32

ShowWindow
MessageBoxW
GetCursorPos

oleaut32

SysFreeString
SysAllocStringByteLen
SysStringLen
SysAllocString

wininet

InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb48f360299641b1c7e17a6073a5ead8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

oleaut32

wininet

Sections

.text Size: 94KB - Virtual size: 93KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 6KB - Virtual size: 13KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 94KB - Virtual size: 93KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 6KB - Virtual size: 13KB

.reloc
Size: 8KB - Virtual size: 7KB