e9969731173d80e6b0099a49c73a1e11bcb2dfac36be89c8fdcd86ab36059b24

Sharing

Copy URL Twitter E-mail

General

Target

e9969731173d80e6b0099a49c73a1e11bcb2dfac36be89c8fdcd86ab36059b24
Size

1.2MB
MD5

c1afd839c2d718d313822f3e3886958a
SHA1

f1ef3879ecf31296c43ddb30c3f911f0ee43f578
SHA256

e9969731173d80e6b0099a49c73a1e11bcb2dfac36be89c8fdcd86ab36059b24
SHA512

37ec61857b79b6dafbf8b3bd688c6ddcb60c7bf2c82f0cb90de8686862074374c2586de7350871414850d0c963c1b7998802eae3e78c9df2a3a74cc15c09c796
SSDEEP

6144:dLwKA3d92v4FJNZlbdy5oKG2+LzIlMMdPBCj2/ycTbaggwu0K0uPkv2em:nAN92wFT0SLIxq3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9969731173d80e6b0099a49c73a1e11bcb2dfac36be89c8fdcd86ab36059b24

Files

e9969731173d80e6b0099a49c73a1e11bcb2dfac36be89c8fdcd86ab36059b24
.exe windows:5 windows x64

e03ae44da593afc1ac1149321bd00636

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

user32

LoadStringW
MessageBeep

msvcrt

__lconv_init
signal
_wcmdln
__winitenv
_initterm
_fpreset
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__setusermatherr
__C_specific_handler
sprintf
bsearch
strcspn
strchr
strlen
strcmp
strcpy
memcmp
wcstok
_getdrive
isalnum
isalpha
_errno
_snwprintf
_wcsupr
_wgetdcwd
_wpopen
_wfopen
fgetws
_pclose
fclose
qsort
memmove
free
memchr
realloc
vswprintf
wcsstr
_wcsnset
wcspbrk
wcsncat
wcscpy
wcscmp
_wchdir
towupper
_wtol
wcstoul
wcstol
_itow
rand
_vsnwprintf
swprintf
_wcsnicmp
_wtoi
memcpy
_wcsicmp
wcsrchr
wcsncpy
wcscat
wcslen
memset
wcsspn
wcsncmp
wcscspn
wcschr
_wcsdup
iswctype
towlower
malloc
_wcslwr

kernel32

TlsGetValue
GetModuleHandleA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
GetStartupInfoW
HeapReAlloc
LockResource
LoadResource
FindResourceExW
FlushFileBuffers
WriteConsoleW
WideCharToMultiByte
HeapFree
HeapAlloc
GetProcessHeap
LocalReAlloc
LocalAlloc
GetEnvironmentVariableA
GetVersionExW
GetFileType
SetProcessAffinityMask
ResumeThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
MoveFileW
WriteConsoleOutputCharacterW
FillConsoleOutputCharacterW
MoveFileExW
CopyFileW
DeviceIoControl
GlobalMemoryStatus
GetLocaleInfoW
GetDateFormatW
RemoveDirectoryW
CreateDirectoryW
lstrcmpW
lstrcmpiW
LocalFree
FormatMessageW
GetVolumePathNameW
GetVolumeInformationW
GetDiskFreeSpaceW
Sleep
SetLocalTime
GetLocalTime
FreeConsole
AllocConsole
GetCurrentProcess
DuplicateHandle
WriteFile
VirtualFree
VirtualAlloc
SystemTimeToFileTime
SetFileTime
SetFileAttributesW
GetSystemTime
GetFileTime
GetFileAttributesW
FindNextFileW
DeleteFileW
CopyFileExW
SetConsoleTitleW
SetConsoleTextAttribute
SetConsoleCursorPosition
SetConsoleCursorInfo
GetConsoleMode
FlushConsoleInputBuffer
FillConsoleOutputAttribute
GetConsoleScreenBufferInfo
WriteConsoleInputW
SetConsoleMode
SetConsoleCtrlHandler
GetConsoleTitleW
GetConsoleOutputCP
GetConsoleCP
WaitForMultipleObjects
TryEnterCriticalSection
TerminateProcess
SetStdHandle
SetHandleInformation
SetFileApisToOEM
lstrlenW
AddConsoleAliasW
GetConsoleAliasW
GetConsoleAliasesW
GetConsoleAliasesLengthW
CloseHandle
CreateFileW
GetFileSize
GetFullPathNameW
ReadFile
SetFilePointer
SetLastError
MultiByteToWideChar
Beep
GetStdHandle
GetTickCount
WaitForSingleObject
ReadConsoleInputW
CreatePipe
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileW
FreeLibrary
GetCommandLineW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetExitCodeProcess
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
SearchPathW
SetCurrentDirectoryW
SetEnvironmentVariableW

ntdll

RtlIsDosDeviceName_U
RtlAssert
vDbgPrintExWithPrefix

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1020KB - Virtual size: 1020KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e03ae44da593afc1ac1149321bd00636

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

msvcrt

kernel32

ntdll

Sections

.text Size: 189KB - Virtual size: 189KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 3KB - Virtual size: 97KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1020KB - Virtual size: 1020KB

.reloc Size: 512B - Virtual size: 496B

.text
Size: 189KB - Virtual size: 189KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 3KB - Virtual size: 97KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1020KB - Virtual size: 1020KB

.reloc
Size: 512B - Virtual size: 496B