9b3adbb6f68c5ee47abdd815fcec74cc022ab48e461f779e6f76bc896cde4c55

Sharing

Copy URL Twitter E-mail

General

Target

9b3adbb6f68c5ee47abdd815fcec74cc022ab48e461f779e6f76bc896cde4c55
Size

850KB
MD5

6c65019f0535dd3cde7864775decf138
SHA1

626be5c6d848bff6f3533bd05941d21b67b04012
SHA256

9b3adbb6f68c5ee47abdd815fcec74cc022ab48e461f779e6f76bc896cde4c55
SHA512

84544654992d6b685360197def321677db4ce1599ff3b992362d98e7937c467f6b42558885da9c98c87132e0f5fe1ce0734f010b0f008b74e0042b21f1099377
SSDEEP

12288:6IVGl7BQcB2J7h51nhtvtxU4/otU2NKFI0lXkHvFPaZz8/S2Mn:6iGl7BQca7h5FhZtP/oYUPFSzCMn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b3adbb6f68c5ee47abdd815fcec74cc022ab48e461f779e6f76bc896cde4c55

Files

9b3adbb6f68c5ee47abdd815fcec74cc022ab48e461f779e6f76bc896cde4c55
.exe windows:5 windows x86

7606dbe3fb9090be768b19b4bb84c5bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WritePrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
FindFirstFileA
FindClose
GetPrivateProfileStringA
ReadFile
GetPrivateProfileStringW
VirtualFree
VirtualAlloc
VirtualProtect
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetLocalTime
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ExitProcess
GetCurrentProcess
LocalFree
GetCommandLineW
CloseHandle
GetLastError
CreateMutexW
SetCurrentDirectoryW
GetModuleFileNameW
HeapSize
SetEndOfFile
GetFileAttributesExW
WriteConsoleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
SleepEx
GetTickCount
WaitForSingleObject
FreeLibrary
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
SetLastError
FormatMessageA
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
WriteFile
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FlushFileBuffers
DecodePointer
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap

advapi32

CryptAcquireContextA
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext

shell32

SHGetSpecialFolderPathW
CommandLineToArgvW

shlwapi

PathRemoveFileSpecW
PathIsDirectoryW

ws2_32

WSAIoctl
socket
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
setsockopt
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
getaddrinfo
ntohs

wldap32

ord200
ord30
ord79
ord35
ord301
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord33
ord143

Sections

.text
Size: 531KB - Virtual size: 530KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7606dbe3fb9090be768b19b4bb84c5bb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

ws2_32

wldap32

Sections

.text Size: 531KB - Virtual size: 530KB

.rdata Size: 108KB - Virtual size: 107KB

.data Size: 4KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 428B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 178KB - Virtual size: 177KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 531KB - Virtual size: 530KB

.rdata
Size: 108KB - Virtual size: 107KB

.data
Size: 4KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 428B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 178KB - Virtual size: 177KB

.reloc
Size: 21KB - Virtual size: 20KB