7ef489af6fc780954a7bd5840bee69713c80a08e28489b4ecf5b73970b6039b9

Sharing

Copy URL Twitter E-mail

General

Target

7ef489af6fc780954a7bd5840bee69713c80a08e28489b4ecf5b73970b6039b9
Size

1.4MB
MD5

79f602ec2592c14107db44b2ae39bc2d
SHA1

f4dd04b57ab975e59cacf811e7b167e8bb60d9f3
SHA256

7ef489af6fc780954a7bd5840bee69713c80a08e28489b4ecf5b73970b6039b9
SHA512

3ff31415e4596182452a498be2928f776941ac9e5482f1dfb08a38c6bc99acb37b18f9c148ce5ddba5202ed7ea0ae2793bd8c1189053672ed63efc0f3827aa93
SSDEEP

12288:RxwxcXlF3msl+EWoNIEuxZsx4QkMxISQmqfn170woja0xS2tVT6hXC5yMrIFOwFT:HacaslCUQsx4MWf1701eGtVTV/rIYkz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ef489af6fc780954a7bd5840bee69713c80a08e28489b4ecf5b73970b6039b9

Files

7ef489af6fc780954a7bd5840bee69713c80a08e28489b4ecf5b73970b6039b9
.exe windows:6 windows x64

8cebd130e0133b13d6a3d23155ef2b8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

EnterCriticalSection
FindNextFileW
LeaveCriticalSection
InitializeCriticalSection
FindClose
DeleteFileW
GetLocalTime
GetFileTime
SetEndOfFile
WriteConsoleW
HeapSize
ReadConsoleW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
ReadFile
SetFilePointerEx
GetFileSizeEx
FindFirstFileW
GetConsoleOutputCP
FlushFileBuffers
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
WriteFile
GetStdHandle
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
CompareFileTime
CreateThread
GetLastError
Sleep
CreateMutexW
CloseHandle
CreateFileW
GetConsoleMode
DeviceIoControl
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetProcAddress
GetModuleHandleW
GetSystemTimeAsFileTime
RtlUnwind
FlsFree
GetCurrentThreadId
WaitForSingleObjectEx
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue

user32

LoadStringW
LoadAcceleratorsW
DefWindowProcW
GetMessageW
GetWindowTextW
IsIconic
GetAncestor
SetForegroundWindow
UnhookWinEvent
RegisterWindowMessageW
SetWinEventHook
GetDesktopWindow
UpdateLayeredWindow
wsprintfW
TranslateAcceleratorW
PostQuitMessage
ChangeWindowMessageFilterEx
FindWindowW
SetFocus
EnumWindows
GetForegroundWindow
GetMonitorInfoW
SetTimer
ShowWindow
RegisterClassExW
GetWindowLongPtrW
GetShellWindow
GetSystemMetrics
CreateWindowExW
MonitorFromWindow
SetWindowPos
IsWindowVisible
DispatchMessageW
GetClassNameW
EndPaint
TranslateMessage
LoadCursorW
SendMessageTimeoutW
GetWindowRect
GetWindowLongW
MonitorFromPoint
FindWindowExW
BeginPaint

gdi32

CreateCompatibleDC
CreateRectRgn
DeleteDC
GetObjectW
DeleteObject
CombineRgn
GetStockObject
SelectObject

advapi32

EventRegister
EventSetInformation
EventUnregister
RegCloseKey
RegOpenKeyExW
RegGetValueW
EventWriteTransfer

shell32

CommandLineToArgvW
SHGetKnownFolderPath

shlwapi

PathFileExistsW

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

gdiplus

GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDeleteRegion
GdipFillRegion
GdipFree
GdipCreateHBITMAPFromBitmap
GdipGraphicsClear
GdipCreateSolidFill
GdipFlush
GdipDisposeImage
GdipAlloc
GdipCreateRegionHrgn
GdipDeleteBrush
GdipCloneImage
GdiplusStartup

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.1MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8cebd130e0133b13d6a3d23155ef2b8d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

api-ms-win-shcore-scaling-l1-1-1

gdiplus

Sections

.text Size: 194KB - Virtual size: 193KB

.rdata Size: 88KB - Virtual size: 87KB

.data Size: 5KB - Virtual size: 13KB

.pdata Size: 10KB - Virtual size: 10KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1.1MB - Virtual size: 1.6MB

.text
Size: 194KB - Virtual size: 193KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 5KB - Virtual size: 13KB

.pdata
Size: 10KB - Virtual size: 10KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1.1MB - Virtual size: 1.6MB