e78e5ba4cf4d39b97f0da988764803c9e443cfef7fe60a8875209bf081b413a9

General

Target

e78e5ba4cf4d39b97f0da988764803c9e443cfef7fe60a8875209bf081b413a9
Size

568KB
MD5

fd30180fc6709fb4d823589314373152
SHA1

0eb28273e5297858adddc8c08bb7e21ef720e6e9
SHA256

e78e5ba4cf4d39b97f0da988764803c9e443cfef7fe60a8875209bf081b413a9
SHA512

21e060b4c628eaf8689ff108c22e957084ff32090ce7ccaeb3a6ce24a690560dcc5c6441fc2145f1e0d2bb341a22908de017967004fe22bdb99106913fbd61a7
SSDEEP

12288:JVvxMj4TIegsI/tBPr6n59bbbYkpuX+3Bx+i+wOe5S34:JVvxQKIeboP6nzYaHMwOek4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e78e5ba4cf4d39b97f0da988764803c9e443cfef7fe60a8875209bf081b413a9

Files

e78e5ba4cf4d39b97f0da988764803c9e443cfef7fe60a8875209bf081b413a9
.exe windows x86

749c9dace2d57aa3cc09e331129d35ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetCurrentProcess
LocalAlloc
LocalFree
CloseHandle
VirtualAllocEx
VirtualFreeEx
CreateRemoteThread
GetExitCodeThread
RtlMoveMemory
lstrcpyn
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
RaiseException
OpenProcess
IsBadReadPtr
GetCurrentProcessId
LCMapStringW
LCMapStringA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW

user32

IsWindow
wsprintfA
MessageBoxA
GetClassNameA
DispatchMessageA
TranslateMessage
IsDialogMessageA
TranslateAcceleratorA
GetParent
GetMessageA
GetWindowThreadProcessId

atl

ord47
ord42

ole32

CLSIDFromString

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 500KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

749c9dace2d57aa3cc09e331129d35ba

Headers

File Characteristics

Imports

kernel32

user32

atl

ole32

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 500KB - Virtual size: 549KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 500KB - Virtual size: 549KB

.rsrc
Size: 4KB - Virtual size: 2KB