78af97bf1b621a9c4e3900c27a6fdc54d1729424b9dd8b5b00d158c5876da353

Sharing

Copy URL Twitter E-mail

General

Target

78af97bf1b621a9c4e3900c27a6fdc54d1729424b9dd8b5b00d158c5876da353
Size

162KB
MD5

7e0aadbaac3a8add5d92ebe470c602ad
SHA1

219d07d00779c8b31f63201708d8e1d02bec7254
SHA256

78af97bf1b621a9c4e3900c27a6fdc54d1729424b9dd8b5b00d158c5876da353
SHA512

fb9fa7328cc324038c0aeaef4bd12102504968ed4f77d7473079f5f351f84d64483b2b8c4c6d0cd69f6dd80e223ba05dc552a994a2074e81a793382e01e41ba7
SSDEEP

3072:4zVnvBpGX2jbynA/YNkk4wVEteRo/zfU0j5T3bxJSkHl:4pPj4UMKeRo/TVRxJSm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78af97bf1b621a9c4e3900c27a6fdc54d1729424b9dd8b5b00d158c5876da353

Files

78af97bf1b621a9c4e3900c27a6fdc54d1729424b9dd8b5b00d158c5876da353
.exe windows x86

d1f090fbc41747676d09bf998bf802ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileW
FindNextFileW
GetFileAttributesExW
RemoveDirectoryW
CloseHandle
SetUnhandledExceptionFilter
GetLastError
CreatePipe
DeviceIoControl
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
Sleep
GetCurrentProcessId
CreateThread
CreateRemoteThread
GetCurrentThreadId
SetThreadPriority
GetExitCodeThread
ResumeThread
CreateProcessA
OpenProcess
GetTickCount
VirtualProtect
FindClose
VirtualAllocEx
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
LoadLibraryA
LoadLibraryW
CreateSemaphoreA
CreateFileMappingA
OpenFileMappingA
GetLogicalDriveStringsA
CopyFileW
MoveFileW
GetTimeZoneInformation
SetConsoleCtrlHandler
GetVersionExA
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
LocalFree
WideCharToMultiByte
MultiByteToWideChar
InitializeSListHead
DeleteFileW
CreateFileA
CreateDirectoryW
GetCurrentDirectoryW
GetModuleHandleA
FreeLibrary
VirtualQuery
SetCurrentDirectoryW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcess
InitializeCriticalSectionAndSpinCount

user32

GetSystemMetrics
GetWindowThreadProcessId
GetClassNameA
EnumWindows
MessageBoxA
GetWindowTextA
FindWindowA

advapi32

RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExW

ole32

CoUninitialize
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

oleaut32

SysFreeString
GetErrorInfo
VariantInit
VariantChangeType
SetErrorInfo
SysAllocString
VariantClear
CreateErrorInfo

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__current_exception
_except_handler4_common
__current_exception_context
memset
__std_terminate
_purecall
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_exit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
__p___argc
exit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
__p___argv
_get_narrow_winmain_command_line
_initterm
_initterm_e
_controlfp_s
_c_exit
_crt_atexit
_execute_onexit_table
_register_thread_local_exe_atexit_callback
terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__acrt_iob_func
fgets
__stdio_common_vswprintf
__stdio_common_vfprintf
fopen
fflush
__stdio_common_vsprintf
_open_osfhandle
fwrite
ftell
fseek
fclose
_wfopen
feof
fread
__stdio_common_vsscanf

api-ms-win-crt-convert-l1-1-0

wcstombs
mbstowcs

api-ms-win-crt-string-l1-1-0

_strlwr
_wcslwr
isspace

api-ms-win-crt-time-l1-1-0

_localtime64
_time64

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32
_wchmod

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1f090fbc41747676d09bf998bf802ed

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 127KB - Virtual size: 127KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 1KB - Virtual size: 22KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 127KB - Virtual size: 127KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 1KB - Virtual size: 22KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 6KB - Virtual size: 6KB