1dcd4dbe1c01a03181589e847badc24b18f383ac68f58404ed1ee875f48e6531

General

Target

1dcd4dbe1c01a03181589e847badc24b18f383ac68f58404ed1ee875f48e6531
Size

337KB
MD5

da1e92e0806ce5aa46d1c769592b4c64
SHA1

94e367cf011c50a16b7758b443276a58f5afe2cd
SHA256

1dcd4dbe1c01a03181589e847badc24b18f383ac68f58404ed1ee875f48e6531
SHA512

09b4d1e7bbed02a5c7f98f6b50d326457593ef861d21c42671cba8f0a9f6c403e92233f7abe3b9986828706d72ab9653a8d5be6cd6c4b43b402042fb16f1a35f
SSDEEP

6144:0pWMSmgY0IyFpXjsCEqhp3xuo8Pr7Jjc7wPxfCg:hHP7LFVst+0oA71+ACg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1dcd4dbe1c01a03181589e847badc24b18f383ac68f58404ed1ee875f48e6531

Files

1dcd4dbe1c01a03181589e847badc24b18f383ac68f58404ed1ee875f48e6531
.exe windows:5 windows x86

c3803752167a683f3dbd2e2ab3d19b6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

powrprof

IsPwrHibernateAllowed
ReadGlobalPwrPolicy

kernel32

LoadLibraryExW
LocalFree
GetCurrentConsoleFont
AddConsoleAliasA
HeapWalk
HeapCreate
EraseTape
EnumSystemLocalesA
GetModuleHandleW
GetProcessAffinityMask
SetFileAttributesW
DeleteVolumeMountPointW
LockFile
GetLocaleInfoW
FillConsoleOutputAttribute
GetConsoleCursorInfo
GlobalFindAtomA
GetProcAddress
LoadLibraryA
GetModuleHandleA
GlobalAddAtomW
FindFirstFileA

wininet

RetrieveUrlCacheEntryStreamW

msvcrt

memset

user32

GetWindowRect
InsertMenuA
GetClipboardFormatNameA
SetCursor
ShowCaret
IsWindow

ole32

CoFreeUnusedLibrariesEx

gdi32

GetDeviceCaps
GetObjectW
GetCharWidthW
GetPaletteEntries
GetBitmapBits

winspool.drv

FindNextPrinterChangeNotification

Sections

.rda
Size: 304KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.m5Fih
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3803752167a683f3dbd2e2ab3d19b6d

Headers

DLL Characteristics

File Characteristics

Imports

powrprof

kernel32

wininet

msvcrt

user32

ole32

gdi32

winspool.drv

Sections

.rda Size: 304KB - Virtual size: 300KB

.rdata Size: 4KB - Virtual size: 3KB

.data1 Size: 20KB - Virtual size: 31KB

.m5Fih Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 1KB

.rda
Size: 304KB - Virtual size: 300KB

.rdata
Size: 4KB - Virtual size: 3KB

.data1
Size: 20KB - Virtual size: 31KB

.m5Fih
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 1KB