9576f63af6e9f58eff816282b336e091f2220ab7078192e354014563028c4e67

Sharing

Copy URL Twitter E-mail

General

Target

9576f63af6e9f58eff816282b336e091f2220ab7078192e354014563028c4e67
Size

533KB
MD5

70fab7b96d60f291b804de2cfd148d02
SHA1

048ce492c670e57778a4c6381c30625cdf5dcd98
SHA256

9576f63af6e9f58eff816282b336e091f2220ab7078192e354014563028c4e67
SHA512

765108921001405de9d8b9e8c80fd8eb2465efa7a870cf0d231a659f66782dab1f1c5c81761c07d622f4c7e6427caa7249196900da58c57bbc6b63fbb4215485
SSDEEP

3072:fFX38OEt5JB3vXEensfcRWAD9KczpkzNIEqAX66bHWtswozEuZCpJzsT9:fFn8OEt8JYuNIEpK6b2Cwoz1ZCLo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9576f63af6e9f58eff816282b336e091f2220ab7078192e354014563028c4e67

Files

9576f63af6e9f58eff816282b336e091f2220ab7078192e354014563028c4e67
.exe windows x86

fa7d7466cee05353ab0cfe2f89e6b3f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CreateMutexW
FindResourceA
SizeofResource
LockResource
LoadResource
FindResourceExA
GetProcAddress
LoadLibraryA
ReadFile
CreateFileW
WaitForSingleObject
ReleaseMutex
FreeLibrary
GetVersion
LoadLibraryW
EndUpdateResourceA
UpdateResourceW
BeginUpdateResourceW
MapViewOfFile
CreateFileMappingA
CreateEventA
DuplicateHandle
UnmapViewOfFile
CreateThread
SetEvent
FlushFileBuffers
GetCurrentThread
GetCurrentProcess
WaitForMultipleObjects
CloseHandle
GetCurrentProcessId
SetEnvironmentVariableW
CreateProcessA
GetModuleFileNameW
FindResourceW
CreateEventW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
RtlUnwind
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
Sleep
ExitProcess
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA

user32

wsprintfW
MessageBoxW

advapi32

OpenThreadToken
OpenProcessToken
FreeSid
GetTokenInformation
EqualSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
AllocateAndInitializeSid

Exports

Exports

??4CLogInBootICE@@QAEAAV0@ABV0@@Z
??4CLogWriter@@QAEAAV0@ABV0@@Z

Sections

.text
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 440KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa7d7466cee05353ab0cfe2f89e6b3f1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 71KB - Virtual size: 72KB

.rdata Size: 16KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 440KB - Virtual size: 440KB

.text
Size: 71KB - Virtual size: 72KB

.rdata
Size: 16KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 440KB - Virtual size: 440KB