32bb3845ba3ab35e0001002b34db5e83a5a6c46b10165bcb636521d98c717494

General

Target

32bb3845ba3ab35e0001002b34db5e83a5a6c46b10165bcb636521d98c717494
Size

576KB
MD5

a9e9116b9686fbb3cf7e11f25f93e449
SHA1

e830bd6d3011de0396ca8553d83ac3a675249e42
SHA256

32bb3845ba3ab35e0001002b34db5e83a5a6c46b10165bcb636521d98c717494
SHA512

e184cd0bc6f7471d9e3b9c671dc5ed4e485ecee44d4a8aac3f3947c9402d9fd4cb8b4781a858a0c988f128b17f4b39b9fa23b230839b682d3da12721e7f134a4
SSDEEP

12288:foaGU8T01WtS5l0WJTTJqbTYsfuEW9g5nSO6slbVUPaWRNx3VlZLIE:fZGLgvXTJgXJX5nJbqPJPFh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32bb3845ba3ab35e0001002b34db5e83a5a6c46b10165bcb636521d98c717494

Files

32bb3845ba3ab35e0001002b34db5e83a5a6c46b10165bcb636521d98c717494
.exe windows x86

23520986f98f747bba59ecac66d9b111

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
LocalAlloc
LocalFree
CloseHandle
GetModuleHandleA
VirtualAllocEx
VirtualFreeEx
CreateRemoteThread
GetExitCodeThread
RtlMoveMemory
lstrcpyn
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
RaiseException
OpenProcess
IsBadReadPtr
GetCurrentProcessId
LCMapStringW
LCMapStringA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW

user32

IsWindow
wsprintfA
MessageBoxA
GetClassNameA
DispatchMessageA
TranslateMessage
IsDialogMessageA
TranslateAcceleratorA
GetParent
GetMessageA
GetWindowThreadProcessId

atl

ord47
ord42

ole32

CLSIDFromString

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 500KB - Virtual size: 550KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

23520986f98f747bba59ecac66d9b111

Headers

File Characteristics

Imports

kernel32

user32

atl

ole32

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 500KB - Virtual size: 550KB

.rsrc Size: 12KB - Virtual size: 8KB

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 500KB - Virtual size: 550KB

.rsrc
Size: 12KB - Virtual size: 8KB