e4c8aa50e88f5a503f666ef0b318a535290523f0a0c7eea70a9b0963dc1a6da9

Sharing

Copy URL

Twitter E-mail

General

Target

e4c8aa50e88f5a503f666ef0b318a535290523f0a0c7eea70a9b0963dc1a6da9
Size

145KB
MD5

1ca64145d07ebfbf1bd6a0e998c55e77
SHA1

d5c3024f65a1d9c4e9b45290b70cf8c42c09da85
SHA256

e4c8aa50e88f5a503f666ef0b318a535290523f0a0c7eea70a9b0963dc1a6da9
SHA512

0c91284a5884ba5a7eb4c9fd8ddf1b5a2b739debfa35dcca17b6b9a855d2d0ac0aa1457bbe1d805fdc90e0fa0b9a49898d0e846e188b1a83108704168a345b99
SSDEEP

384:l4JFNbE+s+Qcv/CvtWPe4JGzEyjy+Ow+hy:IFNbOcvXhQjUXg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e4c8aa50e88f5a503f666ef0b318a535290523f0a0c7eea70a9b0963dc1a6da9

Files

e4c8aa50e88f5a503f666ef0b318a535290523f0a0c7eea70a9b0963dc1a6da9
.exe windows:5 windows x86

d6396f21ed990a7a49f236e2444d03e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
LoadLibraryW
GetProcAddress
OutputDebugStringW
Sleep
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateMutexW
RaiseException
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
FindResourceExW
GetCurrentThreadId
SetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetPrivateProfileStringW
GetModuleHandleW
CreateDirectoryW
CloseHandle
LeaveCriticalSection
GetCurrentProcess
GetModuleFileNameW
GetVersionExW
DecodePointer
GetLastError
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
WritePrivateProfileStringW
EnterCriticalSection
FreeLibrary
LoadResource
OpenMutexW
FindResourceW

user32

GetClientRect
DestroyWindow
DefWindowProcW
FindWindowW
MonitorFromPoint
GetClassNameW
KillTimer
SetTimer
DispatchMessageW
TranslateMessage
GetMessageW
CallWindowProcW
FindWindowExW
CopyRect
PostQuitMessage
RegisterClassExW
LoadCursorW
UnregisterClassW
GetMonitorInfoW
IsWindow
GetClassInfoExW
GetWindowThreadProcessId
SetParent
IsWindowVisible
ShowWindow
InvalidateRect
EndPaint
BeginPaint
SetWindowLongW
GetWindowLongW
CreateWindowExW
SendMessageW
PostMessageW
SetWindowPos
ClientToScreen

advapi32

RegDeleteValueW
RegOpenKeyExW
RegCloseKey

shell32

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ

exceptcatch

SetExceptionCatcher

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
memmove
memset
wcschr
wcsstr
__std_terminate
memcpy
__CxxFrameHandler3
wcsrchr

api-ms-win-crt-runtime-l1-1-0

_exit
exit
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_get_wide_winmain_command_line
_initialize_wide_environment
_invalid_parameter_noinfo
_controlfp_s
_errno
_configure_wide_argv
_seh_filter_exe
_cexit
_initterm
_set_app_type
_initialize_onexit_table
_crt_atexit
terminate
_register_onexit_function

api-ms-win-crt-heap-l1-1-0

_recalloc
free
_set_new_mode
malloc
_callnewh

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vswprintf
__stdio_common_vswprintf_s

api-ms-win-crt-time-l1-1-0

_time64
_difftime64

api-ms-win-crt-string-l1-1-0

wcsnlen
wmemcpy_s
_wcslwr_s
_wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d6396f21ed990a7a49f236e2444d03e8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

msvcp140

exceptcatch

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 30KB - Virtual size: 30KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 93KB - Virtual size: 93KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 30KB - Virtual size: 30KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 93KB - Virtual size: 93KB

.reloc
Size: 3KB - Virtual size: 2KB