da4d2259c36a6ed64d300057bdb745195efc7104010c729ab251e65f485aa123

General

Target

da4d2259c36a6ed64d300057bdb745195efc7104010c729ab251e65f485aa123
Size

5.6MB
MD5

7011807fe5f1ac0217f580ca1af4e11e
SHA1

2201baed97d1e83e91d3a9f6531d06dbbdfc43c0
SHA256

da4d2259c36a6ed64d300057bdb745195efc7104010c729ab251e65f485aa123
SHA512

629d6adc725569ec183e7ec33beb09563917bb75ac818dcc4713c57718659ded6a0d3120601995af645b85623eab38e5134dc7721220a8960045fdadcc963791
SSDEEP

98304:dHamNpPWVAf68uPPs6uip1ZQN3UrBnlVn/:d6mNUOSHs6dbl5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da4d2259c36a6ed64d300057bdb745195efc7104010c729ab251e65f485aa123

Files

da4d2259c36a6ed64d300057bdb745195efc7104010c729ab251e65f485aa123
.exe windows x86

aefd2ba79f4a30d123544d14415dd5f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetProcAddress
GetModuleHandleExA
lstrcpynA
RtlMoveMemory
GetCurrentProcess
ReadProcessMemory
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CloseHandle
WriteFile
CreateFileA
ReadFile
GetFileSize
GetLocalTime
FreeLibrary
LoadLibraryA
LCMapStringA

msvcrt

atoi
_ftol
??2@YAPAXI@Z
??3@YAXPAX@Z
_atoi64
atof
sprintf
free
malloc
strchr
realloc
modf
memmove
strncmp
__CxxFrameHandler

user32

GetWindowTextA
GetWindowTextLengthA
GetWindowLongA
SetWindowPos
ScreenToClient
GetWindowRect
SetWindowLongA
ShowWindow
GetDlgItem
wsprintfA
PostQuitMessage
DestroyWindow
DispatchMessageA
TranslateMessage
SendMessageA
GetMessageA
UpdateWindow
CreateDialogIndirectParamA
SetWindowTextA
MessageBoxA

shlwapi

PathFileExistsA

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 832KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

xeng
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

aefd2ba79f4a30d123544d14415dd5f4

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

shlwapi

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 832KB - Virtual size: 1.2MB

.rsrc Size: 24KB - Virtual size: 24KB

xeng Size: 408KB - Virtual size: 408KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 832KB - Virtual size: 1.2MB

.rsrc
Size: 24KB - Virtual size: 24KB

xeng
Size: 408KB - Virtual size: 408KB