98337065E3F088E5EB59583C9FB8DB18[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

98337065E3F088E5EB59583C9FB8DB18.exe
Size

146KB
MD5

98337065e3f088e5eb59583c9fb8db18
SHA1

bbde710a083a66af4be481258e60973a3c4197b6
SHA256

e5a60a6177873f5584225f166ad23200d034e6bba001ec63fb8bb4b0c22cc72d
SHA512

ada803298828ef10ba92b21b8e44ad666d22c7f8e20cb013065b346657a9ad0c15b6ebde9bdb8b9f09b9ae11a5faeea9547c7890e311cf55787011a11cbf562e
SSDEEP

1536:H3ZreAQmHhPjPkev/d96546su0rZarLAzN+szexKcayTgsTLd+ccZws8jcdWEg2n:XZywrki944NguNL6xKHqLd+hWEw+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
98337065E3F088E5EB59583C9FB8DB18.exe

Files

98337065E3F088E5EB59583C9FB8DB18.exe
.exe windows:6 windows x86

4ae5c0352a2707ad3f145fcc46657af5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetConsoleCP
GetFileType
GetStdHandle
GetCurrentThreadId
IsDebuggerPresent
GetProcessHeap
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
HeapSize
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CreateFileW
CloseHandle
EnumTimeFormatsW
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapFree
RaiseException
RtlUnwind
GetCommandLineW
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
LCMapStringW

setupapi

SetupQueueCopySectionA
SetupInstallServicesFromInfSectionW
SetupGetFileCompressionInfoA
SetupGetSourceFileSizeA
SetupCopyErrorA

rtm

MgmDeRegisterMProtocol
RtmBlockConvertRoutesToStatic
RtmCreateEnumerationHandle
RtmGetRouteAge
RtmGetFirstRoute

user32

CreateDesktopA
LoadImageW
LoadCursorW
MessageBoxW
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
DdeAddData
TrackMouseEvent

crypt32

CryptMsgVerifyCountersignatureEncoded
CryptSignAndEncryptMessage

comdlg32

ReplaceTextA
GetOpenFileNameW

mscms

CheckBitmapBits
IsColorProfileTagPresent
ord1
InstallColorProfileW
RegisterCMMW
SetStandardColorSpaceProfileA
DeleteColorTransform

gdi32

DeleteDC
DeleteObject
StretchBlt
SetStretchBltMode
CreateCompatibleDC
GetObjectW

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4ae5c0352a2707ad3f145fcc46657af5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

setupapi

rtm

user32

crypt32

comdlg32

mscms

gdi32

Sections

.text Size: 97KB - Virtual size: 97KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 12KB - Virtual size: 20KB

.text
Size: 97KB - Virtual size: 97KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 12KB - Virtual size: 20KB