dafe660f6a2fd9065842395a9f204557d36d03f92f0c3cc43dd3692a7c47e548

Sharing

Copy URL Twitter E-mail

General

Target

dafe660f6a2fd9065842395a9f204557d36d03f92f0c3cc43dd3692a7c47e548
Size

169KB
MD5

ebfc61a47e85debe04640052eb49350c
SHA1

cbf8242764a416e099e1ef3269b5d2af2d94fc33
SHA256

dafe660f6a2fd9065842395a9f204557d36d03f92f0c3cc43dd3692a7c47e548
SHA512

a193ffc2e3b699d983e8adacd8873d2985c3339834447302c137d83a48671cd1235935aba3b3bbd094f631f127bf99c570d2a1ddac6bbf80837a458e7ee9461c
SSDEEP

3072:LsQSZ0BF85TpLh7homC+D8V3JAFmjCB/QpYuyiEwBCYhMWFz:Lxup1Om9mA5/Q4Ye+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dafe660f6a2fd9065842395a9f204557d36d03f92f0c3cc43dd3692a7c47e548

Files

dafe660f6a2fd9065842395a9f204557d36d03f92f0c3cc43dd3692a7c47e548
.exe windows:6 windows x86

f6153f39fcd1c11c65c0c92a11614389

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW
PathRemoveFileSpecW

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

kernel32

WaitForSingleObject
HeapSize
CreateToolhelp32Snapshot
CreateEventW
FormatMessageW
GetLastError
Process32NextW
SetEvent
lstrcatW
TlsAlloc
Process32FirstW
HeapReAlloc
CloseHandle
HeapAlloc
DecodePointer
SetCurrentDirectoryW
WriteConsoleW
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
TlsFree
FormatMessageA
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
LeaveCriticalSection
GetModuleFileNameW
TerminateProcess
GetStdHandle
lstrlenW
GetCurrentProcess
GetCommandLineW
EnterCriticalSection
HeapFree
GetStartupInfoW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
ReadConsoleW
CreateFileW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetEndOfFile
ReadFile
LocalFree
CompareStringW
GetTimeFormatW
GetTimeZoneInformation
GetFileType
GetDateFormatW
IsDebuggerPresent
OutputDebugStringW
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetProcAddress
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
RtlUnwind
SetLastError
EncodePointer
TlsGetValue
TlsSetValue
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
WriteFile

user32

KillTimer
TranslateMessage
SetTimer
DispatchMessageW
GetMessageW
DefWindowProcW
CreateWindowExW
RegisterClassExW

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerExW
RevertToSelf
CreateServiceW
RegCloseKey
CloseServiceHandle
OpenSCManagerW
ChangeServiceConfig2W
RegCreateKeyExW
ImpersonateLoggedOnUser
RegSetValueExW
StartServiceW
RegOpenKeyExW
CreateProcessAsUserW
StartServiceCtrlDispatcherW
OpenServiceW
DuplicateTokenEx
GetTokenInformation

shell32

CommandLineToArgvW

ws2_32

WSAStartup
WSACleanup

wevtapi

EvtSubscribe
EvtClose

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f6153f39fcd1c11c65c0c92a11614389

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

wtsapi32

userenv

kernel32

user32

advapi32

shell32

ws2_32

wevtapi

Sections

.text Size: 117KB - Virtual size: 116KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 76KB

.text
Size: 117KB - Virtual size: 116KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 76KB