f257b78547e13e455df3b77ffcc493c4a174ccb5b93db86be4708300601a0474

Sharing

Copy URL Twitter E-mail

General

Target

f257b78547e13e455df3b77ffcc493c4a174ccb5b93db86be4708300601a0474
Size

1.5MB
MD5

33b40fcd88fc30c3b104fbb4da42bc49
SHA1

ca5437a51a50676c80734c2f82c91d5a2f6a9ed9
SHA256

f257b78547e13e455df3b77ffcc493c4a174ccb5b93db86be4708300601a0474
SHA512

26287ac35762c357d560359cfa8e15c2334b2c3e06364f889bddf75e1635133f538f68e112202e19629b28b323fd16fe04caf53d1e7da59a071b8e78a10e5c31
SSDEEP

24576:/dR6TqeiOpCidLRGH+LHiFl+bmTNbVPCw:/dkToOpCidEeLCFlhJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f257b78547e13e455df3b77ffcc493c4a174ccb5b93db86be4708300601a0474

Files

f257b78547e13e455df3b77ffcc493c4a174ccb5b93db86be4708300601a0474
.exe windows:6 windows x64

5aee692bea4202939eac1e27da07197a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateMutexW
GetLastError
GetConsoleOutputCP
HeapSize
LCMapStringW
CompareStringW
GetModuleHandleA
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FindFirstFileExW
GetCommandLineA
FreeEnvironmentStringsW
GetModuleHandleExW
ReleaseMutex
FindClose
ReleaseSRWLockShared
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
QueryPerformanceFrequency
WriteFile
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
DuplicateHandle
SetFilePointerEx
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SystemTimeToFileTime
GetCurrentProcessId
EncodePointer
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
TryAcquireSRWLockExclusive
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
RaiseException
CreateDirectoryW
FindFirstFileW
CreateEventW
ReadFile
GetOverlappedResult
CancelIo
RtlPcToFileHeader
RtlUnwindEx
GetConsoleMode
GetFileType
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
SystemTimeToTzSpecificLocalTime
CreateNamedPipeW
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
TzSpecificLocalTimeToSystemTime
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
GetStdHandle
CloseHandle

user32

PostQuitMessage
LoadIconW
LoadCursorW
RegisterClassW
CreateWindowExW
DefWindowProcW
SetForegroundWindow
GetMenuItemID
TrackPopupMenu
CreatePopupMenu
SetMenuInfo
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
InsertMenuItemW
LoadImageW
GetCursorPos

shell32

Shell_NotifyIconW

advapi32

SystemFunction036

ntdll

NtReadFile
RtlNtStatusToDosError
NtWriteFile

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5aee692bea4202939eac1e27da07197a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

advapi32

ntdll

bcrypt

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 307KB - Virtual size: 306KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 66KB - Virtual size: 65KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 307KB - Virtual size: 306KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 66KB - Virtual size: 65KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 6KB - Virtual size: 6KB