66531db6cf5fbd41552cd72d26397d457996e0e12b67d1190b3445f3312dbb5b

Sharing

Copy URL

Twitter E-mail

General

Target

66531db6cf5fbd41552cd72d26397d457996e0e12b67d1190b3445f3312dbb5b
Size

176KB
MD5

4504a663c9dedd8115032cd2586d4779
SHA1

c995d03316bcd6f633cbe822d14e6780853d1d9e
SHA256

66531db6cf5fbd41552cd72d26397d457996e0e12b67d1190b3445f3312dbb5b
SHA512

98a0992f76e823fc847cfb15d9774f5dcd765fbd297d8447d2378d444ae5dccf152829bda7e7ec9b92368dc078d37d060fc0b7e383872569f4e4ee42d40c1531
SSDEEP

3072:G2C8cQF25Rb37rpbt9AEqhauW6lkGbw1eV+hEWEZAM:G26O25B3XNt9AlRWuM9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66531db6cf5fbd41552cd72d26397d457996e0e12b67d1190b3445f3312dbb5b

Files

66531db6cf5fbd41552cd72d26397d457996e0e12b67d1190b3445f3312dbb5b
.exe windows x64

28b05531ab517b9bbf48e75a47747f07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

CommandLineToArgvW

kernel32

GetStdHandle
WriteConsoleW
LoadLibraryA
GetProcAddress
VirtualAlloc
lstrcpyW
lstrcpyA
lstrlenW
CreateFileA
GetFileSize
ReadFile
WriteFile
SetEndOfFile
HeapReAlloc
HeapSize
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCurrentProcess
TerminateProcess
GetProcessHeap
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
SetFilePointerEx
GetFileType
GetConsoleMode
ReadConsoleW
HeapAlloc
HeapFree
CloseHandle
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
CreateFileW

ntdll

RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28b05531ab517b9bbf48e75a47747f07

Headers

DLL Characteristics

File Characteristics

Imports

shell32

kernel32

ntdll

Sections

.text Size: 101KB - Virtual size: 100KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 3KB - Virtual size: 9KB

.pdata Size: 6KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 148B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 101KB - Virtual size: 100KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 3KB - Virtual size: 9KB

.pdata
Size: 6KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 2KB - Virtual size: 1KB