1f03b182c1a67ad1676508facfcb4a6c95108218647b215d69068f6ae47f5d38

Sharing

Copy URL Twitter E-mail

General

Target

1f03b182c1a67ad1676508facfcb4a6c95108218647b215d69068f6ae47f5d38
Size

495KB
MD5

0a82701a19319ed3d59cc31385f5bece
SHA1

166c247c52afb42eec17c0ad846579abcb49fb64
SHA256

1f03b182c1a67ad1676508facfcb4a6c95108218647b215d69068f6ae47f5d38
SHA512

c8ea60f4a30022edfc4d56f221a50bc71f319c145e2b0a95e1e5416481224b14baedf36c1f841b0627f70391b0a7193122f8ee4abd1b39580351230f7bc5dc7d
SSDEEP

6144:vU4BGavWCzddDuiVqP5DwUiBUWtAFIodTxAOXvHrefY6kJrEvxRTLLD6VLAA:vU4GPCxZurREUiBUWtqJVvLM11L3A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f03b182c1a67ad1676508facfcb4a6c95108218647b215d69068f6ae47f5d38

Files

1f03b182c1a67ad1676508facfcb4a6c95108218647b215d69068f6ae47f5d38
.exe windows:5 windows x86

579478228f1044938ff1ec5e23379477

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CreateFileW
ResumeThread
HeapSize
GetLastError
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
FindClose
CreateMutexW
FindNextFileW
ReadFile
WriteFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
HeapFree
ExitProcess
OutputDebugStringA
lstrcmpiW
OutputDebugStringW
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetACP
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
SetEndOfFile
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetCurrentProcessId
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter

user32

GetMessageW
TranslateMessage
UnregisterClassW
GetClassInfoExW
KillTimer
SetWindowLongW
DispatchMessageW
RegisterClassExW
CreateWindowExW
CallWindowProcW
DefWindowProcW
LoadCursorW
GetWindowLongW

advapi32

RegCreateKeyA
RegCloseKey
RegCreateKeyW
RegQueryValueExW

winhttp

WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpOpen
WinHttpOpenRequest

shlwapi

PathRemoveFileSpecW
PathAppendW

Exports

Exports

?$TSS0@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAAUPolymorphicCasters@34@XZ@4HA
??4?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@QAEAAV012@ABV012@@Z
?create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAAUPolymorphicCasters@23@XZ
?getInstance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@SAAAUPolymorphicCasters@23@XZ
?instance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@0AAUPolymorphicCasters@23@A
?t@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAAUPolymorphicCasters@34@XZ@4U534@A

Sections

.text
Size: 274KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 118KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

579478228f1044938ff1ec5e23379477

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

winhttp

shlwapi

Exports

Exports

Sections

.text Size: 274KB - Virtual size: 274KB

.rdata Size: 82KB - Virtual size: 82KB

.data Size: 6KB - Virtual size: 9KB

.rsrc Size: 118KB - Virtual size: 120KB

.text
Size: 274KB - Virtual size: 274KB

.rdata
Size: 82KB - Virtual size: 82KB

.data
Size: 6KB - Virtual size: 9KB

.rsrc
Size: 118KB - Virtual size: 120KB