d8c3858ccbbe20d203aa827f843b1c1f1b02b994ccb2c6fa379c177aa576d1bb

Sharing

Copy URL

Twitter E-mail

General

Target

d8c3858ccbbe20d203aa827f843b1c1f1b02b994ccb2c6fa379c177aa576d1bb
Size

13.2MB
MD5

0ce8abe598b3c4885acd2609aeba84da
SHA1

7ea0aaf0bda772c33151bbc829b099b022e418a3
SHA256

d8c3858ccbbe20d203aa827f843b1c1f1b02b994ccb2c6fa379c177aa576d1bb
SHA512

70d6206a41b60f56798e19664d81c9b6fe1b22ae14d6db34f395f98b2a736cc9ba724beb37e67a6d4c93bf94306ead789348369730fecc7834e13dd46ac8e821
SSDEEP

393216:eHWGkC2UgH5RgTMpc8a1a1SzE0B8VXAjaN3LvvQI:eEDbbgTMpc8a1aEz/Bn+N3z7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8c3858ccbbe20d203aa827f843b1c1f1b02b994ccb2c6fa379c177aa576d1bb

Files

d8c3858ccbbe20d203aa827f843b1c1f1b02b994ccb2c6fa379c177aa576d1bb
.exe windows:5 windows x86

7f426951e432f6e821071cd16657569f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveOutUnprepareHeader

ws2_32

inet_ntoa

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA

rasapi32

RasHangUpA

kernel32

GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadStringA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

CreateBrushIndirect

msimg32

GradientFill

winspool.drv

ClosePrinter

comdlg32

GetFileTitleA

advapi32

RegCreateKeyExA

shell32

Shell_NotifyIconA

ole32

OleInitialize

oleaut32

UnRegisterTypeLi

comctl32

ImageList_Create

wininet

InternetGetConnectedState

wtsapi32

WTSSendMessageW

Sections

.xilou
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xilou
Size: - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xilou
Size: - Virtual size: 599KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xilou
Size: - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xilou
Size: - Virtual size: 24B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xilou
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xilou
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xilou
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xilou
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7f426951e432f6e821071cd16657569f

Headers

File Characteristics

Imports

winmm

ws2_32

msvfw32

avifil32

rasapi32

kernel32

user32

gdi32

msimg32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

wininet

wtsapi32

Sections

.xilou Size: - Virtual size: 1.0MB

.xilou Size: - Virtual size: 585KB

.xilou Size: - Virtual size: 599KB

.xilou Size: - Virtual size: 97KB

.xilou Size: - Virtual size: 24B

.xilou Size: - Virtual size: 2.7MB

.xilou Size: 5.1MB - Virtual size: 5.1MB

.xilou Size: 72KB - Virtual size: 68KB

.xilou Size: 8.0MB - Virtual size: 8.0MB

.xilou
Size: - Virtual size: 1.0MB

.xilou
Size: - Virtual size: 585KB

.xilou
Size: - Virtual size: 599KB

.xilou
Size: - Virtual size: 97KB

.xilou
Size: - Virtual size: 24B

.xilou
Size: - Virtual size: 2.7MB

.xilou
Size: 5.1MB - Virtual size: 5.1MB

.xilou
Size: 72KB - Virtual size: 68KB

.xilou
Size: 8.0MB - Virtual size: 8.0MB