e8f80a213c83ffb3b44340882db51cb70f4ad7f6ebddb6c191d651103a763d12

Sharing

Copy URL

Twitter E-mail

General

Target

e8f80a213c83ffb3b44340882db51cb70f4ad7f6ebddb6c191d651103a763d12
Size

538KB
MD5

ec090db307e59e16c3e2d931af1b66dc
SHA1

2cfe6e270e055ec1d8c526860a599f5aca1bd7d2
SHA256

e8f80a213c83ffb3b44340882db51cb70f4ad7f6ebddb6c191d651103a763d12
SHA512

29d91f18f2bcbca2ea54ec71a4128949c070bbcf34ca9c997c88203f2e09a8e5e8423c168dfca047d47c3234a825c3cca4f8f4395d18207d050f76f6346bf653
SSDEEP

6144:DlySFgrkypkANoHhDrzM70BO1nO5Uo7AOqdrhxihUKlSb7v31p79Fhc0Uq7+VB5:Dl+pk6oBbMASO5vArIeNp79Xck7yD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8f80a213c83ffb3b44340882db51cb70f4ad7f6ebddb6c191d651103a763d12

Files

e8f80a213c83ffb3b44340882db51cb70f4ad7f6ebddb6c191d651103a763d12
.exe windows:6 windows x86

809c8dfdf5ba2d31d98402c0e485fc99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

CreateEnvironmentBlock

kernel32

GetCurrentThreadId
CreateThread
Sleep
CreateEventW
WaitForSingleObject
SetEvent
GetCommandLineW
MultiByteToWideChar
FindResourceW
lstrcmpiW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
OpenProcess
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
CloseHandle
SetEndOfFile
DecodePointer
WriteConsoleW
SetStdHandle
LocalAlloc
FreeEnvironmentStringsW
LoadLibraryW
WideCharToMultiByte
ReadFile
SetLastError
GetCurrentProcess
WriteFile
CreateFileW
FormatMessageW
LocalFree
GetFileSize
InitializeCriticalSectionAndSpinCount
FindNextFileW
FindClose
GetFileAttributesW
GetSystemDirectoryW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
FlushFileBuffers
CreateMutexW
ReleaseMutex
OpenMutexW
GetCurrentProcessId
HeapFree
OutputDebugStringW
HeapAlloc
GetProcessHeap
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
IsDebuggerPresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
InitializeSListHead
RtlUnwind
GetModuleHandleExW
HeapReAlloc
ExitProcess
GetStdHandle
GetACP
HeapSize
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
IsValidCodePage
GetOEMCP
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW

user32

wsprintfW
MessageBoxW
CharNextW
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW
SetTimer

advapi32

RegCloseKey
GetSecurityDescriptorSacl
ChangeServiceConfig2W
RegQueryValueExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
RegDeleteKeyW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
SetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
CreateProcessAsUserW
OpenProcessToken
AllocateAndInitializeSid
DuplicateTokenEx
EqualSid
FreeSid
GetTokenInformation
RegCreateKeyExW
CloseServiceHandle

ole32

CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoUninitialize
CoTaskMemFree
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
StringFromGUID2
CoInitializeEx
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeSecurity

oleaut32

SysAllocString
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
VarUI4FromStr
UnRegisterTypeLi
SysFreeString
SysStringLen
RegisterTypeLi

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shell32

SHGetFolderPathW

Sections

.text
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

809c8dfdf5ba2d31d98402c0e485fc99

Headers

DLL Characteristics

File Characteristics

Imports

userenv

kernel32

user32

advapi32

ole32

oleaut32

version

shell32

Sections

.text Size: 231KB - Virtual size: 230KB

.rdata Size: 99KB - Virtual size: 98KB

.data Size: 8KB - Virtual size: 61KB

.rsrc Size: 107KB - Virtual size: 107KB

.reloc Size: 82KB - Virtual size: 84KB

.text
Size: 231KB - Virtual size: 230KB

.rdata
Size: 99KB - Virtual size: 98KB

.data
Size: 8KB - Virtual size: 61KB

.rsrc
Size: 107KB - Virtual size: 107KB

.reloc
Size: 82KB - Virtual size: 84KB