938f5ab3faf6d229e982d2d4fa729686748fd61dfe125302d521aca3397f91a3

Sharing

Copy URL

Twitter E-mail

General

Target

938f5ab3faf6d229e982d2d4fa729686748fd61dfe125302d521aca3397f91a3
Size

10.3MB
MD5

620befa7e7238c735ffa4ca29b296eeb
SHA1

9a1b984f549b191f733cbccdac6847d6dba6ff26
SHA256

938f5ab3faf6d229e982d2d4fa729686748fd61dfe125302d521aca3397f91a3
SHA512

6536b01789de2c435162b35f6450c04d6b9a9588c11fa6b25cbe790cd067875dd1f571586f3af1714df1015aa02dae20be961c7b6dd689bce938d37005e5a754
SSDEEP

196608:2SoCHDKBRPGRCQK97TuJghali4NE0apE7V0xQoOBzWhKtM02D8khcRwTl5egOhU+:8ODKBdGRM7GRNE0apE7V0xQoOBzWh+Mu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
938f5ab3faf6d229e982d2d4fa729686748fd61dfe125302d521aca3397f91a3

Files

938f5ab3faf6d229e982d2d4fa729686748fd61dfe125302d521aca3397f91a3
.exe windows:5 windows x86

18629a7a227fe7ad84e02e17f6265e5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

kernel32

GetDiskFreeSpaceA
GetSystemDirectoryA
GetSystemInfo
ReadFile
GetEnvironmentVariableA
WaitForSingleObject
GetCurrentProcess
MultiByteToWideChar
FindClose
FindNextFileA
FindFirstFileA
LocalAlloc
SetFileAttributesA
GetFileAttributesA
RemoveDirectoryA
GetTickCount
GetFileAttributesExA
CreateProcessA
GetStartupInfoA
CreatePipe
WriteConsoleW
SetStdHandle
FormatMessageA
lstrlenA
GetModuleHandleA
OpenProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateMutexA
OpenMutexA
CreateEventA
SetEvent
DeleteFileA
GetModuleFileNameA
MoveFileA
GetWindowsDirectoryA
CopyFileA
GetPrivateProfileIntA
LoadLibraryExA
GetProcAddress
Sleep
CreateDirectoryA
GetLocalTime
CreateFileA
GetLastError
CreateFileW
SetFilePointer
WriteFile
GetCurrentThreadId
CloseHandle
LocalFree
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
MoveFileExA
LoadLibraryW
FreeLibrary
GetExitCodeProcess
GetConsoleMode
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
GetConsoleCP

user32

ExitWindowsEx

advapi32

RegDeleteValueA
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
QueryServiceConfigA
QueryServiceStatusEx
StartServiceA
SetServiceStatus
LockServiceDatabase
QueryServiceLockStatusA
UnlockServiceDatabase
ChangeServiceConfigA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateGuid

Sections

.text
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18629a7a227fe7ad84e02e17f6265e5b

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 287KB - Virtual size: 287KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 7KB - Virtual size: 16KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 287KB - Virtual size: 287KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 7KB - Virtual size: 16KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 12KB - Virtual size: 11KB