d1028ede9e1451a36c25902f192b8a2cb2ae637ffd5dc38d337884d5343fd4d3

Sharing

Copy URL Twitter E-mail

General

Target

d1028ede9e1451a36c25902f192b8a2cb2ae637ffd5dc38d337884d5343fd4d3
Size

3.5MB
MD5

6edc2c08373a3982617df08c6906b077
SHA1

6519b16e4b2463785cca26b9eaec75020c8006ad
SHA256

d1028ede9e1451a36c25902f192b8a2cb2ae637ffd5dc38d337884d5343fd4d3
SHA512

e7d2125bc40a3b4ab396f8601eb130fab8592f05d7d4fe0700d61f34833387c2cf48c0fd7fb925728604266f0b788adffe78d9eb39bd011e655c0aa3cb30470f
SSDEEP

98304:t8U9JQaQN1o5PVZX/I/riFDB/ksKENCB4MetXgtQM:dmo5PVZXcridB/CdetXgtQM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1028ede9e1451a36c25902f192b8a2cb2ae637ffd5dc38d337884d5343fd4d3

Files

d1028ede9e1451a36c25902f192b8a2cb2ae637ffd5dc38d337884d5343fd4d3
.exe windows x86

fa0aaf7105c0793bd46c79d83d602a86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32 kernel32

RegOpenKeyExA �a7

kernel32

CloseHandle
ReadFile
SetFilePointer
CreateFileA
ExitProcess
TerminateProcess
GetCurrentProcess
WinExec
lstrcatA
GetModuleFileNameA
GetCommandLineA
DeleteFileA
VirtualAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualFree
GetModuleHandleA
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
GetStringTypeA
LCMapStringW
GetVersion
HeapFree
HeapAlloc
HeapReAlloc
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
GetStringTypeW

ws2_32

WSACleanup

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.K2game
Size: 544KB - Virtual size: 544KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.K2game
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.K2game
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.K2game
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa0aaf7105c0793bd46c79d83d602a86

Headers

File Characteristics

Imports

advapi32 kernel32

kernel32

ws2_32

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.K2game Size: 544KB - Virtual size: 544KB

.K2game Size: 16KB - Virtual size: 16KB

.K2game Size: 8KB - Virtual size: 8KB

.K2game Size: 4KB - Virtual size: 4KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.K2game
Size: 544KB - Virtual size: 544KB

.K2game
Size: 16KB - Virtual size: 16KB

.K2game
Size: 8KB - Virtual size: 8KB

.K2game
Size: 4KB - Virtual size: 4KB