8057a4bb4dd5a7dd0e6a508cd311ff5ca408993f5ed48767eabff972e5ba2bba

Sharing

Copy URL Twitter E-mail

General

Target

8057a4bb4dd5a7dd0e6a508cd311ff5ca408993f5ed48767eabff972e5ba2bba
Size

3.9MB
MD5

a9bf4ecc97f276bb56985cb1f29bfdfb
SHA1

ed2b16ea9f6d795f6d32c7d0c020a1e1298f66f8
SHA256

8057a4bb4dd5a7dd0e6a508cd311ff5ca408993f5ed48767eabff972e5ba2bba
SHA512

62b0e7e5987e2ebee03a57aa50870d5e491b906120bfbfc3484d5e7569be0ceb3ac30581d7410a120ae756abe8c8bffda6fab3a446aef7c4d4e037853838d57b
SSDEEP

24576:MNpsM335u1GXPb49EBnMYyMPwo3DNnQeoOnmR:MNWM3358GfM9iMYyryDNnQanmR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8057a4bb4dd5a7dd0e6a508cd311ff5ca408993f5ed48767eabff972e5ba2bba

Files

8057a4bb4dd5a7dd0e6a508cd311ff5ca408993f5ed48767eabff972e5ba2bba
.exe windows x86

26dfe478729816b8fb157fdeefb53866

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
MultiByteToWideChar
WriteConsoleW
SetFilePointer
HeapAlloc
SetStdHandle
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetFileType
RaiseException
HeapReAlloc
CreateFileW
GetStringTypeW
LCMapStringW
VirtualAlloc
FlushFileBuffers
GlobalMemoryStatusEx
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
HeapSize
Sleep
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
EncodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
RtlUnwind
GetLastError
HeapFree
CloseHandle
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
IsProcessorFeaturePresent
DeleteCriticalSection
LoadLibraryW
GetStdHandle
GetModuleFileNameW

user32

LoadBitmapA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
EndDialog
KillTimer
SetTimer
DialogBoxParamA
DestroyWindow
DefWindowProcA
BeginPaint
EndPaint
InvalidateRect
PostQuitMessage
CreateWindowExA
GetSystemMetrics
MoveWindow
GetDC
ReleaseDC
ShowWindow
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
LoadAcceleratorsA

gdi32

SetTextColor
SetBkColor
TextOutA
DeleteDC
CreateCompatibleDC
CreateFontA
Rectangle
GetStockObject
CreateSolidBrush
SelectObject
BitBlt
GetObjectA
DeleteObject
GetTextExtentPoint32A

wininet

FtpGetFileSize
FtpOpenFileA
InternetConnectA
InternetOpenA
InternetReadFile

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26dfe478729816b8fb157fdeefb53866

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

wininet

Sections

.text Size: 45KB - Virtual size: 45KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 3.8MB - Virtual size: 3.8MB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

.reloc
Size: 15KB - Virtual size: 14KB