4cda67c22a80331b05348bcfe63b5084c7815fb903a3ef41f9ba6f765d7f4044

Sharing

Copy URL

Twitter E-mail

General

Target

4cda67c22a80331b05348bcfe63b5084c7815fb903a3ef41f9ba6f765d7f4044
Size

9.4MB
MD5

427433e2b1afbfea656de859577476f2
SHA1

89dec5ea0a9d41a54b0789b1afbee1e29b736802
SHA256

4cda67c22a80331b05348bcfe63b5084c7815fb903a3ef41f9ba6f765d7f4044
SHA512

1074736146c0fa1538cae884ddc16506bb6c18e657d16a1f04d62f8783a3a36b578728a9946f79d0c5955db80662731a962fe3162900c595a0275225ba16f87d
SSDEEP

196608:QLSGZvaZWcLuPijDWuNgYYLFXNo+wdeC6LalzOC+K:KaZWcLuKjaSEdwdeCxX+K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cda67c22a80331b05348bcfe63b5084c7815fb903a3ef41f9ba6f765d7f4044

Files

4cda67c22a80331b05348bcfe63b5084c7815fb903a3ef41f9ba6f765d7f4044
.exe windows:5 windows x86

3636816dfca359f0825cc5a2555a9438

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

kernel32

LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
OpenProcess
CreateToolhelp32Snapshot
Process32First
SizeofResource
GetModuleFileNameA
Sleep
LocalAlloc
CreateEventA
CreateThread
WaitForSingleObject
ExpandEnvironmentStringsA
WriteFile
ReadFile
GetFileSize
CreateFileA
GetLastError
CloseHandle
SetFileAttributesA
GetFileAttributesExA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
SetFilePointer
SetStdHandle
Process32Next
CreateFileW
WriteConsoleW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetCommandLineA
HeapSetInformation
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetCPInfo
CompareStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
GetModuleFileNameW
GetStartupInfoW
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
QueryServiceConfigA
EnumServicesStatusA
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
CreateProcessAsUserA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
StartServiceCtrlDispatcherA

shlwapi

PathFileExistsA

ws2_32

psapi

EnumProcessModules
EnumProcesses
GetModuleFileNameExA

Sections

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lcs0
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.lcs1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lcs2
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3636816dfca359f0825cc5a2555a9438

Headers

DLL Characteristics

File Characteristics

Imports

userenv

kernel32

advapi32

shlwapi

ws2_32

psapi

Sections

.text Size: 116KB - Virtual size: 116KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 16KB - Virtual size: 16KB

.lcs0 Size: 3.0MB - Virtual size: 3.0MB

.lcs1 Size: 4KB - Virtual size: 4KB

.lcs2 Size: 6.2MB - Virtual size: 6.2MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.l1 Size: 5KB - Virtual size: 5KB

.text
Size: 116KB - Virtual size: 116KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 16KB - Virtual size: 16KB

.lcs0
Size: 3.0MB - Virtual size: 3.0MB

.lcs1
Size: 4KB - Virtual size: 4KB

.lcs2
Size: 6.2MB - Virtual size: 6.2MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.l1
Size: 5KB - Virtual size: 5KB