d9871377f11221682cd2960efe20cefe7c3cf4008a9cc7d9ffba18f0e91a92b7

Sharing

Copy URL Twitter E-mail

General

Target

d9871377f11221682cd2960efe20cefe7c3cf4008a9cc7d9ffba18f0e91a92b7
Size

154KB
MD5

4ddb53664930025967ea98ca5a904197
SHA1

f550f30ba1aaf5f1e29237ef234a277330c6f94c
SHA256

d9871377f11221682cd2960efe20cefe7c3cf4008a9cc7d9ffba18f0e91a92b7
SHA512

0cbacd8ad86eb2e968c6bef6322e900c22c538eb75770a930a3444993132dc7d1cb0589fa17f20b6753525f23800b26af4a025438ab76e06ae0978a04050dff5
SSDEEP

3072:OxNJYWFzkX/EAVgPpBJKWAJWniQSlOYF:gzQPIXJHAJWni1Oc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9871377f11221682cd2960efe20cefe7c3cf4008a9cc7d9ffba18f0e91a92b7

Files

d9871377f11221682cd2960efe20cefe7c3cf4008a9cc7d9ffba18f0e91a92b7
.exe windows:5 windows x86

558e0e682ec9f352d73c9c39649f5c89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?what@exception@std@@UBEPBDXZ
strcpy_s
free
__FrameUnwindFilter
sprintf
??0exception@std@@QAE@ABV01@@Z
memset
??2@YAPAXI@Z
_cexit
strcat_s
_encoded_null
_decode_pointer
_encode_pointer
_amsg_exit
malloc
??_V@YAXPAX@Z
??1exception@std@@UAE@XZ
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
??3@YAXPAX@Z
abort

kernel32

CloseHandle
CreateFileA
GetLastError
Sleep
CreateEventA
WriteFile
WaitForSingleObject
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetOverlappedResult
CancelIo
QueryPerformanceCounter
GetTickCount
ReadFile
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
PurgeComm

msvcm90

?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ

msvcp90

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$allocator@_W@std@@QAE@ABV01@@Z

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

mscoree

_CorExeMain

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

558e0e682ec9f352d73c9c39649f5c89

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

kernel32

msvcm90

msvcp90

setupapi

mscoree

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 1024B - Virtual size: 11KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 1024B - Virtual size: 11KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB