0fb14afd694157906753ba6e8aa590ea02ecc4009ec6731ed6d71cbcda9d589b

Sharing

Copy URL Twitter E-mail

General

Target

0fb14afd694157906753ba6e8aa590ea02ecc4009ec6731ed6d71cbcda9d589b
Size

60KB
MD5

0ceb4fbf091b8e8e076fca62989d00d6
SHA1

81eb67c8e58292db53bbdbbc2dc8123f864e7ad1
SHA256

0fb14afd694157906753ba6e8aa590ea02ecc4009ec6731ed6d71cbcda9d589b
SHA512

2a06ee0fbba3c05e6067c4ed45b0f707f90ef462dbfa83dcb649670a998d3d3eaff6d2942fe36420657b93b7992a9372e5e85ff5687615105e5cd8e11cd671de
SSDEEP

768:wjCCnGzunYy9EkCIiPeExcnuRXoZef2majLKfGaS30g/ZFmP0z:7CGzu0kdiPNLXoZefYvKfGaQ00mU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fb14afd694157906753ba6e8aa590ea02ecc4009ec6731ed6d71cbcda9d589b

Files

0fb14afd694157906753ba6e8aa590ea02ecc4009ec6731ed6d71cbcda9d589b
.exe windows:4 windows x86

97b37e44725ffc599b92b54ef804415e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__commode
__p__fmode
_adjust_fdiv
_controlfp
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
wcscmp
_except_handler3
_beginthreadex
sscanf
??2@YAPAXI@Z
__CxxFrameHandler
_snprintf
??3@YAXPAX@Z
__set_app_type
??1type_info@@UAE@XZ
_CxxThrowException
wcslen

kernel32

GetTickCount
LocalFree
Sleep
InterlockedExchange
GetStartupInfoA
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
InterlockedDecrement
CreateMutexA
GetLastError
GetModuleFileNameA
GetShortPathNameA
ReleaseMutex
GetCurrentThreadId
lstrlenA

user32

GetClientRect
SendMessageA
PostQuitMessage
DefWindowProcA
CreateWindowExA
LoadStringA
ShowWindow
UpdateWindow
SystemParametersInfoA
LoadIconA
LoadCursorA
RegisterClassExA
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowExA
GetForegroundWindow
GetWindowThreadProcessId
SetForegroundWindow
AttachThreadInput

ole32

OleInitialize
OleCreate
OleSetContainedObject

oleaut32

VariantClear
SysAllocString
SysFreeString

wininet

InternetCrackUrlA

shlwapi

StrStrIA

ws2_32

send
recv
htons
connect
WSAStartup
WSACleanup
closesocket
socket
ioctlsocket
gethostbyname
inet_addr
__WSAFDIsSet
select
WSAGetLastError

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

97b37e44725ffc599b92b54ef804415e

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

ole32

oleaut32

wininet

shlwapi

ws2_32

Sections

.text Size: 12KB - Virtual size: 10KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 36KB - Virtual size: 100KB

.text
Size: 12KB - Virtual size: 10KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 36KB - Virtual size: 100KB