9f1a1df00b4d5abc0ca9983b5cc3c84889ed83cc7b28c94fa2d1fb45551df7c9

Sharing

Copy URL

Twitter E-mail

General

Target

9f1a1df00b4d5abc0ca9983b5cc3c84889ed83cc7b28c94fa2d1fb45551df7c9
Size

8.6MB
MD5

7e858cf4c2c458132ebe632137a2d8a6
SHA1

2ffc9275bf4017b4e11a07a3bec5861b78d88dd5
SHA256

9f1a1df00b4d5abc0ca9983b5cc3c84889ed83cc7b28c94fa2d1fb45551df7c9
SHA512

62134478ee9e2635d13fe4d2e37561635e1e579a5c659be2dfd6aa150670dd0c43283c98838f9e3ea643df68d4f06ba50e5b0a635855b339e9600fe41afaae4b
SSDEEP

196608:Ccx2zVFOad1ISjzapRzmfTu3Js5AjU0FtgKs:CC2zV4al6XzwCZs5AjUGgKs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f1a1df00b4d5abc0ca9983b5cc3c84889ed83cc7b28c94fa2d1fb45551df7c9

Files

9f1a1df00b4d5abc0ca9983b5cc3c84889ed83cc7b28c94fa2d1fb45551df7c9
.exe windows x86

0555a038703ab25974129be3988892f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
EnterCriticalSection
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
GetCurrentThreadId
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
TryEnterCriticalSection
HeapReAlloc
GetSystemInfo
SetCurrentDirectoryW
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetCurrentProcessId
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
GetModuleHandleA
GetVersion
GetFileType
GlobalMemoryStatus
FlushConsoleInputBuffer
LoadLibraryW
OpenProcess
FindResourceW
LoadResource
FreeResource
SizeofResource
AreFileApisANSI
GetStdHandle
FreeLibrary
GetVersionExA
SetLastError
GetComputerNameA
OutputDebugStringW
CreateFileA
GetCommandLineW
WideCharToMultiByte
GetFileSize
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
SetFileAttributesW
GetFileAttributesW
VirtualAlloc
WriteFile
lstrlenW
VirtualFree
ReadFile
GetSystemTime
SystemTimeToFileTime
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
CreateDirectoryW
DeleteFileA
FindClose
FindNextFileW
FindFirstFileW
GetDiskFreeSpaceExW
MultiByteToWideChar
GetProcessHeap
GetComputerNameW
LocalFree
HeapAlloc
CloseHandle
GetSystemDirectoryA
GetLastError
CreateFileW
GetVolumeInformationA
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
DeviceIoControl
HeapFree
GetTickCount
CopyFileW
MoveFileExW
DeleteFileW
LockResource
HeapCompact
IsValidLocale
GetConsoleCP
GetACP
SetConsoleMode
ReadConsoleInputA
EncodePointer
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetCurrentDirectoryW
GetModuleFileNameW
RemoveDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetVolumePathNameW
MoveFileW
RtlUnwind
LoadLibraryExW
FindFirstFileExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetConsoleMode

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
wsprintfW

advapi32

GetSidSubAuthorityCount
LookupAccountNameW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RevertToSelf
ImpersonateLoggedOnUser
RegCreateKeyW
GetSidSubAuthority
GetUserNameW
GetSidIdentifierAuthority
CryptDestroyKey
CryptAcquireContextA
CryptEncrypt
CryptDeriveKey
RegCreateKeyExW
ConvertSidToStringSidA
LookupAccountNameA
RegEnumKeyExW
CryptAcquireContextW
CopySid
CryptCreateHash
CryptHashData
IsValidSid
RegSetValueExW
CryptDestroyHash
GetLengthSid
CryptGetHashParam
CryptReleaseContext
OpenProcessToken
RegQueryValueExW
GetTokenInformation
RegCloseKey
RegOpenKeyExW
ConvertSidToStringSidW

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

ole32

CoInitialize
CoCreateGuid

oleaut32

SysAllocString
SysFreeString

shlwapi

PathIsRelativeW
PathCombineW
SHSetValueW
PathFileExistsW
StrCmpNIW
PathAddBackslashW
PathAppendW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0555a038703ab25974129be3988892f6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 264KB - Virtual size: 264KB

.data Size: 16KB - Virtual size: 36KB

.gfids Size: 1024B - Virtual size: 568B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 7.1MB - Virtual size: 7.1MB

.reloc Size: 47KB - Virtual size: 46KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 264KB - Virtual size: 264KB

.data
Size: 16KB - Virtual size: 36KB

.gfids
Size: 1024B - Virtual size: 568B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 7.1MB - Virtual size: 7.1MB

.reloc
Size: 47KB - Virtual size: 46KB