e8be6aaecfddc9a4276ad81c02e666d8c99e9c43d98f71feb987027a6d50f406

Sharing

Copy URL Twitter E-mail

General

Target

e8be6aaecfddc9a4276ad81c02e666d8c99e9c43d98f71feb987027a6d50f406
Size

410KB
MD5

fd51a9b1b76e39f19d775dc751b44cda
SHA1

ba5580dd95c20449352e037fe00787157e7cb132
SHA256

e8be6aaecfddc9a4276ad81c02e666d8c99e9c43d98f71feb987027a6d50f406
SHA512

ced8fc47d12cd527362fe0d2827ca5785142e9ff533d8d57be8558cc64398c62b696c79bf4fc185d0f8764a7a00e5fbba973578fa91e8fb3b7a1609a44921d07
SSDEEP

12288:DJTiWYgeWYg955/155/59Gc0fpKR1lAu65ouW1bHu:DJTvGDk1lAn5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8be6aaecfddc9a4276ad81c02e666d8c99e9c43d98f71feb987027a6d50f406

Files

e8be6aaecfddc9a4276ad81c02e666d8c99e9c43d98f71feb987027a6d50f406
.exe windows:6 windows x64

0bdf642bb5cb01c4bc5904e531912e92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetConsoleWindow
GetLastError
GetModuleHandleW
FormatMessageA
SetLastError
GlobalMemoryStatusEx
QueryPerformanceFrequency
CreateFileW
GetCurrentThread
VirtualProtect
QueryPerformanceCounter
GetModuleFileNameA
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetCurrentThreadId
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetProcAddress
GetStringTypeW
GetCPInfo
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
RtlUnwindEx
InterlockedPushEntrySList
RtlPcToFileHeader
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
HeapReAlloc
HeapSize
CompareStringW
LCMapStringW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW

user32

ShowWindow

wininet

InternetOpenUrlA
InternetOpenW
InternetCloseHandle
InternetReadFile

Sections

.text
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0bdf642bb5cb01c4bc5904e531912e92

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

wininet

Sections

.text Size: 279KB - Virtual size: 279KB

.rdata Size: 102KB - Virtual size: 101KB

.data Size: 10KB - Virtual size: 5.8MB

.pdata Size: 13KB - Virtual size: 12KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 279KB - Virtual size: 279KB

.rdata
Size: 102KB - Virtual size: 101KB

.data
Size: 10KB - Virtual size: 5.8MB

.pdata
Size: 13KB - Virtual size: 12KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 4KB - Virtual size: 3KB