0fab95bebb6537000d082905da2c7785c010d261d5a4eba98c717ed216bb798f

Sharing

Copy URL Twitter E-mail

General

Target

0fab95bebb6537000d082905da2c7785c010d261d5a4eba98c717ed216bb798f
Size

7.0MB
MD5

e3fc75528313907dce92fd5b858dd40e
SHA1

95379cf42f303363a4d44bb7d88895df00ee6187
SHA256

0fab95bebb6537000d082905da2c7785c010d261d5a4eba98c717ed216bb798f
SHA512

f4cdba53f78bf3bce380a1e6f20190bd6caa8c7dc52fc0d9cb936af1119acae65cc5a0de6d0821f2250946e929522baac92342304ca915154c98f8e95ce38592
SSDEEP

196608:KotZgs21BRYdoQlSOLM8gYQtP72i2g2z3p1D:KotZoBRR0tL9gYQtP7j2xXD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fab95bebb6537000d082905da2c7785c010d261d5a4eba98c717ed216bb798f

Files

0fab95bebb6537000d082905da2c7785c010d261d5a4eba98c717ed216bb798f
.exe windows:5 windows x86

5ca26cea0981c756f4872b90f82189e0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueW

mpr

WNetGetConnectionA

ole32

CreateStreamOnHGlobal

comctl32

_TrackMouseEvent

shell32

ShellExecuteA

comdlg32

GetOpenFileNameA

wsock32

WSACleanup

gdiplus

GdipSetStringFormatLineAlign

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

shlwapi

PathFindExtensionA

ws2_32

WSAStartup

wininet

InternetSetCookieA

winhttp

WinHttpCheckPlatform

oledlg

ord8

icmp

IcmpCreateFile

winspool.drv

ClosePrinter

Sections

.text
Size: 4.0MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

hero
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

duen
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hero
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hero
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ca26cea0981c756f4872b90f82189e0

Headers

File Characteristics

Imports

kernel32

oleaut32

advapi32

user32

gdi32

version

mpr

ole32

comctl32

shell32

comdlg32

wsock32

gdiplus

msvcrt

iphlpapi

psapi

shlwapi

ws2_32

wininet

winhttp

oledlg

icmp

winspool.drv

Sections

.text Size: 4.0MB - Virtual size: 8.7MB

.rsrc Size: 15KB - Virtual size: 16KB

hero Size: 4KB - Virtual size: 4KB

duen Size: - Virtual size: 1.1MB

text Size: - Virtual size: 1.0MB

.hero Size: 1.9MB - Virtual size: 1.9MB

.idata Size: 1KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

.hero Size: 4KB - Virtual size: 4KB

.text
Size: 4.0MB - Virtual size: 8.7MB

.rsrc
Size: 15KB - Virtual size: 16KB

hero
Size: 4KB - Virtual size: 4KB

duen
Size: - Virtual size: 1.1MB

text
Size: - Virtual size: 1.0MB

.hero
Size: 1.9MB - Virtual size: 1.9MB

.idata
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.hero
Size: 4KB - Virtual size: 4KB