b0a90a177858bbc76987e72b2c44ef44cc23eca6512265a7b5bba38b6efc6840

Sharing

Copy URL Twitter E-mail

General

Target

b0a90a177858bbc76987e72b2c44ef44cc23eca6512265a7b5bba38b6efc6840
Size

1.7MB
MD5

286e354085111443a96f3faa8504cdfd
SHA1

98cb17328d148dfa87a8bf46d3d22009f3d3555c
SHA256

b0a90a177858bbc76987e72b2c44ef44cc23eca6512265a7b5bba38b6efc6840
SHA512

cab0d37030e1b2779b30b6ac8ed1d5de0b4e5ac3c9ddd329c4b11790a8f6968d2c9aaa1a147d21887309bc7faff6d4f1e374b327c7482ba4c811e34d84935843
SSDEEP

49152:9J+bPzu8bkE3XpkBvoGQHOxDHSCE3zU1DWV0mGS:CzuE3X6BQt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0a90a177858bbc76987e72b2c44ef44cc23eca6512265a7b5bba38b6efc6840

Files

b0a90a177858bbc76987e72b2c44ef44cc23eca6512265a7b5bba38b6efc6840
.exe windows x86

d219958975613c4271034d017ed9cf58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
CloseHandle
GetFileAttributesA
GetUserDefaultUILanguage
GetACP
MultiByteToWideChar
SetConsoleCP
WideCharToMultiByte
SetConsoleOutputCP
GetCurrentProcess
LocalAlloc
GetCurrentThread
LocalFree
IsDebuggerPresent
TransactNamedPipe
CreateMutexA
SetConsoleCursorPosition
GetFileType
FillConsoleOutputAttribute
WriteFile
WriteConsoleA
GetStdHandle
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterA
GetLastError
lstrcmpA
FindClose
FindNextFileA
WaitForSingleObject
WaitForMultipleObjects
SetNamedPipeHandleState
SetLastError
GetSystemTime
RtlCaptureContext
EnterCriticalSection
ReleaseSemaphore
GetProcessId
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
GetCurrentThreadId
LoadLibraryW
CreateThread
GetProcAddress
DeleteCriticalSection
FreeLibrary
CreateSemaphoreW
VirtualQueryEx
SetUnhandledExceptionFilter
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
GetLocaleInfoEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
CopyFileW
GetFileInformationByHandleEx
FindFirstFileA
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
GetStringTypeW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
GetCurrentProcessId
RtlUnwind
InterlockedPushEntrySList
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
GetConsoleCP
SetEnvironmentVariableW
GetFileSizeEx
SetFilePointerEx
HeapAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
HeapReAlloc
GetTimeZoneInformation
HeapSize
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
SetConsoleMode
ReadConsoleInputW
WriteConsoleW
SetEndOfFile
GetModuleFileNameA
WaitNamedPipeW

advapi32

SetSecurityDescriptorDacl
AccessCheck
SetSecurityDescriptorOwner
AllocateAndInitializeSid
IsValidSecurityDescriptor
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
InitializeAcl
DuplicateToken
GetLengthSid
AddAccessAllowedAce
OpenThreadToken
SetSecurityDescriptorGroup

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

wininet

HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetCrackUrlW
InternetReadFile
HttpAddRequestHeadersW
HttpQueryInfoW
InternetOpenW
InternetQueryDataAvailable
HttpOpenRequestW

Exports

Exports

uchardet_data_end
uchardet_delete
uchardet_get_charset
uchardet_handle_data
uchardet_new
uchardet_reset

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 494KB - Virtual size: 494KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d219958975613c4271034d017ed9cf58

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

version

wininet

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 494KB - Virtual size: 494KB

.data Size: 20KB - Virtual size: 73KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 69KB - Virtual size: 68KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 494KB - Virtual size: 494KB

.data
Size: 20KB - Virtual size: 73KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 69KB - Virtual size: 68KB