57bb7b668255b83435eeb56de07232d3b8c2492ccaaf6204c24efa96044a5495

Sharing

Copy URL Twitter E-mail

General

Target

57bb7b668255b83435eeb56de07232d3b8c2492ccaaf6204c24efa96044a5495
Size

1.7MB
MD5

b2e02bdb7279509279812e68601fed55
SHA1

f2738fb2f6bc254a86fcd76ee4725d4a4f7df275
SHA256

57bb7b668255b83435eeb56de07232d3b8c2492ccaaf6204c24efa96044a5495
SHA512

c6265b15dadf6d2342c23e4ed41ec6697c50e077ed7b9786445720754ef1be9b34c665d6783fc1f0a60291bc074ede3e785fa13b99bd3d859c2a3528aecb48f4
SSDEEP

24576:9yRgOs53qbQN1P9IxLyNXO64vvZks8SXiP9c16+B6RJxpObfCmPUr/30auhIkgP:9FOs53qbQNtoGovOsVu9c1bBC/37fk+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57bb7b668255b83435eeb56de07232d3b8c2492ccaaf6204c24efa96044a5495

Files

57bb7b668255b83435eeb56de07232d3b8c2492ccaaf6204c24efa96044a5495
.exe windows x64

c7acd13d116b3b554cc5d4a0926d1712

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OutputDebugStringA
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

ocr_system

?OcrTextFromMem@@YA_NPEBXHPEBDPEAPEAUCOcrResult@@@Z

advapi32

SystemFunction036
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

wtsapi32

WTSSendMessageW

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7acd13d116b3b554cc5d4a0926d1712

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ocr_system

advapi32

wtsapi32

user32

Sections

.text Size: - Virtual size: 92KB

.rdata Size: - Virtual size: 52KB

.data Size: - Virtual size: 10KB

.pdata Size: - Virtual size: 5KB

.gfids Size: - Virtual size: 284B

.vmp0 Size: - Virtual size: 1.9MB

.vmp1 Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 512B - Virtual size: 28B

.rsrc Size: 92KB - Virtual size: 91KB

.text
Size: - Virtual size: 92KB

.rdata
Size: - Virtual size: 52KB

.data
Size: - Virtual size: 10KB

.pdata
Size: - Virtual size: 5KB

.gfids
Size: - Virtual size: 284B

.vmp0
Size: - Virtual size: 1.9MB

.vmp1
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 512B - Virtual size: 28B

.rsrc
Size: 92KB - Virtual size: 91KB