f224827f6ebfb8a0f119df67dbb0869918dd874abedf81f42b29d9f3ab943243

Sharing

Copy URL Twitter E-mail

General

Target

f224827f6ebfb8a0f119df67dbb0869918dd874abedf81f42b29d9f3ab943243
Size

1.6MB
MD5

fe50a337b4c7a80a54235162941e4936
SHA1

42135f64f24cf8eaaad1931380fc8cc00a481cf4
SHA256

f224827f6ebfb8a0f119df67dbb0869918dd874abedf81f42b29d9f3ab943243
SHA512

6ca3e18eb727caed2f97537fef2d0d4b41f81097c9fc26f1feb32107c1e4b284f73cb0a80a13bc20ee85bd2a5de1af4e309a09d4908008c392048f7e6f47d93a
SSDEEP

24576:kfdQbyu6jfm/KuuY72KFJ33AijxeVSmQBg0BAVG5FgU+KUr7QWwaC1zUC:spu6K/4UzHjsI/geEU+lr7Q+MU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f224827f6ebfb8a0f119df67dbb0869918dd874abedf81f42b29d9f3ab943243

Files

f224827f6ebfb8a0f119df67dbb0869918dd874abedf81f42b29d9f3ab943243
.exe windows:6 windows x86

b9cca22160548703008048db78c2fd05

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

LookupPrivilegeValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_except_handler4_common

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_exit

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

wtsapi32

WTSSendMessageW

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hd0
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hd1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9cca22160548703008048db78c2fd05

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

user32

Sections

.text Size: - Virtual size: 5KB

.rdata Size: - Virtual size: 4KB

.data Size: - Virtual size: 142KB

.hd0 Size: - Virtual size: 1.5MB

.hd1 Size: 1.6MB - Virtual size: 1.6MB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 5KB

.rdata
Size: - Virtual size: 4KB

.data
Size: - Virtual size: 142KB

.hd0
Size: - Virtual size: 1.5MB

.hd1
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 512B - Virtual size: 469B