72821ebeeb23992cc9337687ae3d32167411bd99e3d649d0ef56c78707dd26c9

Sharing

Copy URL Twitter E-mail

General

Target

72821ebeeb23992cc9337687ae3d32167411bd99e3d649d0ef56c78707dd26c9
Size

5.5MB
MD5

2764b3d0ad419fdcc578c6a97435af94
SHA1

33b0c97e287e6b01cb8c6de6f6869a8f287ce113
SHA256

72821ebeeb23992cc9337687ae3d32167411bd99e3d649d0ef56c78707dd26c9
SHA512

e381a0209067109bd24a2de4e7bc560c8b798d0a8964d0fe2fbb7a25693a86934ddf7278a5d7c738f0ecad5956783d9917932adbb7987294aba9c9e25c4ed1e7
SSDEEP

98304:5cGu/rc0+bMW3vzzq5X73Wno1tl5no5xKgjDy4asjO4ayjZ4Y:MY0KXq5X6noX/orKw1PyY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72821ebeeb23992cc9337687ae3d32167411bd99e3d649d0ef56c78707dd26c9

Files

72821ebeeb23992cc9337687ae3d32167411bd99e3d649d0ef56c78707dd26c9
.exe windows x86

04646ffc8b71faaa36c8560f6d8b56f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetModuleFileNameA
WriteFile
SetFilePointer
GetCurrentThreadId
GetLastError
CreateFileA
DeleteFileA
CloseHandle
SetFileAttributesA
LocalFree
GetCurrentProcessId
SizeofResource
FindResourceA
LockResource
LoadResource
HeapAlloc
ReadFile
MoveFileExA
GetFileAttributesA
FindClose
GetSystemDirectoryA
OpenProcess
CreateToolhelp32Snapshot
lstrcmpiW
Process32FirstW
Process32NextW
Sleep
TerminateProcess
GetModuleHandleA
FindFirstFileW
lstrcmpW
FindNextFileW
SetEndOfFile
CreateFileW
DeleteFileW
WideCharToMultiByte
GetNativeSystemInfo
LoadLibraryA
VirtualAlloc
VirtualFree
SetLastError
HeapFree
VirtualProtect
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
EnterCriticalSection
FindFirstFileExA
LCMapStringW
CompareStringW
DecodePointer
WriteConsoleW
HeapSize
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
GetStringTypeW
HeapReAlloc
SetFilePointerEx
GetConsoleMode
GetFileType
FindNextFileA

advapi32

CloseServiceHandle
StartServiceA
QueryServiceStatus
ControlService
OpenServiceA
OpenSCManagerW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
SetFileSecurityA
SetFileSecurityW

oleaut32

VariantClear
SysFreeString
SysAllocString

shlwapi

PathFileExistsA
SHSetValueA
SHGetValueA
ord157

winhttp

WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetOption
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpSetTimeouts

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Y%W
Size: 768KB - Virtual size: 767KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04646ffc8b71faaa36c8560f6d8b56f5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

oleaut32

shlwapi

winhttp

Sections

.text Size: 127KB - Virtual size: 127KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 63KB - Virtual size: 66KB

.gfids Size: 512B - Virtual size: 308B

.Y%W Size: 768KB - Virtual size: 767KB

.reloc Size: 7KB - Virtual size: 6KB

.rsrc Size: 4.6MB - Virtual size: 4.6MB

.text
Size: 127KB - Virtual size: 127KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 63KB - Virtual size: 66KB

.gfids
Size: 512B - Virtual size: 308B

.Y%W
Size: 768KB - Virtual size: 767KB

.reloc
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 4.6MB - Virtual size: 4.6MB