8bd934dfab76a438ad876404a79ceaa3507babb1a62138416df1293d71f61504

Sharing

Copy URL Twitter E-mail

General

Target

8bd934dfab76a438ad876404a79ceaa3507babb1a62138416df1293d71f61504
Size

2.8MB
MD5

ec8f64a8b834c0ee19000fd88c4df6b5
SHA1

62275544a700d1e1954323197b65091478effd58
SHA256

8bd934dfab76a438ad876404a79ceaa3507babb1a62138416df1293d71f61504
SHA512

8892aba8a810efd69bf29ef68c8908e0226f9c0d83a1e9a79cb149c8b2cb47e5e01b3fb551d334fa12f752b323c3e6bd339a091722924e20b748476e22240924
SSDEEP

49152:Dcobe+Xmbvh7RyGLcZp8wNtAM3+oT/L3FS:Qoq+2nyucZp8wNaM3fT/LA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8bd934dfab76a438ad876404a79ceaa3507babb1a62138416df1293d71f61504

Files

8bd934dfab76a438ad876404a79ceaa3507babb1a62138416df1293d71f61504
.exe windows:4 windows x86

8f139f8460a2c0f796d82764cb7fc4f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3

mpr

WNetCloseEnum

comctl32

InitializeFlatSB

version

VerQueryValueA
VerLanguageNameW
VerLanguageNameA
VerInstallFileW
VerInstallFileA
VerQueryValueW

kernel32

Module32NextW
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
LeaveCriticalSection
ExitProcess
EnterCriticalSection
InitializeCriticalSection
GetCommandLineA
IsValidCodePage
DeleteCriticalSection
DeleteFileW
EnumSystemLocalesA
ExitThread
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
FindResourceExW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FormatMessageA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeResource
GetACP
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetDiskFreeSpaceExW
GetDriveTypeA
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLocalTime
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileIntW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetThreadLocale
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsProcessorFeaturePresent
IsValidLocale
LCMapStringA
LCMapStringW
LoadLibraryW
LoadResource
LocalFree
LockResource
lstrlenA
lstrlenW
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenEventW
OpenProcess
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
SleepEx
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW

user32

TranslateMessage
SystemParametersInfoW
ShowWindow
SetWindowPos
SetWindowLongW
SetTimer
SetRectEmpty
SetRect
SetForegroundWindow
SetCursor
UnregisterClassA
SetCapture
SetActiveWindow
SendMessageW
ScreenToClient
ReleaseDC

winspool.drv

SetPortW
SetPortA
XcvDataW
SetFormW
WaitForPrinterChange
SetPrinterDataExA
SetPrinterDataW
WritePrinter
StartPagePrinter
StartDocPrinterW
StartDocPrinterA
SetPrinterW
SetPrinterA
SetJobW
SetJobA
SetPrinterDataExW

advapi32

StartServiceW
StartServiceCtrlDispatcherW
StartServiceCtrlDispatcherA
StartServiceA
SetTokenInformation
SetThreadToken
SetServiceStatus
SetServiceObjectSecurity
SetSecurityDescriptorSacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExA
RegDeleteKeyW
RegOpenKeyExA
CloseServiceHandle

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cvm64
Size: 999KB - Virtual size: 999KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8f139f8460a2c0f796d82764cb7fc4f3

Headers

File Characteristics

Imports

msvcrt

mpr

comctl32

version

kernel32

user32

winspool.drv

advapi32

Sections

.text Size: 412KB - Virtual size: 411KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 14.0MB

.tls Size: 4KB - Virtual size: 16B

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.cvm64 Size: 999KB - Virtual size: 999KB

.text
Size: 412KB - Virtual size: 411KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 14.0MB

.tls
Size: 4KB - Virtual size: 16B

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.cvm64
Size: 999KB - Virtual size: 999KB