ede4c609a6b8d998f798def9ccfa120872d2ed01cdf05efd794cfbbbe5df7847

Sharing

Copy URL Twitter E-mail

General

Target

ede4c609a6b8d998f798def9ccfa120872d2ed01cdf05efd794cfbbbe5df7847
Size

6.3MB
MD5

9cf20a9e402dd7c03978c0d1e5cb86f1
SHA1

b3392dccde4b787215e71c5d4e2556ff8f520b06
SHA256

ede4c609a6b8d998f798def9ccfa120872d2ed01cdf05efd794cfbbbe5df7847
SHA512

5a12a9ad7a3ddac1d9665c54b26677d171f3adaa172c3c8749af3c99b618c2480de7064ee22e7a75280536d8209f2ab80fde8de466e87422c794ccfcc2348ec9
SSDEEP

98304:U7fE180Owppkd1n90mQMDafhOMK844lGh0r3hfms5rFY4xZGHUQ6MOCQ53WrP5xD:3OwppK6hM2JOLRoPrdrFzZFQ6Mzz5xfr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ede4c609a6b8d998f798def9ccfa120872d2ed01cdf05efd794cfbbbe5df7847

Files

ede4c609a6b8d998f798def9ccfa120872d2ed01cdf05efd794cfbbbe5df7847
.exe windows:6 windows x86

99817c5c03f6eb75c274bbb37b0ec7ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
CloseHandle
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CompareStringW

utilities

?GetBuffer@?$TStringT@DUchar_traits@SOUI@@@SOUI@@QAEPADH@Z

soui

?TranslateText@STrText@SOUI@@QAEXXZ

version

GetFileVersionInfoSizeW

shell32

SHGetPathFromIDListW

gdi32

CreateDCW

rpcrt4

UuidToStringA

user32

SetPropW

comdlg32

GetSaveFileNameW

advapi32

OpenProcessToken

ole32

OleInitialize

oleaut32

SysAllocStringByteLen

crypt32

CryptDecodeObject

shlwapi

PathIsDirectoryW

ws2_32

WSAAddressToStringW

iphlpapi

GetIfTable

dnsapi

DnsQueryConfig

netapi32

Netbios

wininet

InternetSetOptionW

msimg32

AlphaBlend

Sections

.text
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99817c5c03f6eb75c274bbb37b0ec7ea

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

utilities

soui

version

shell32

gdi32

rpcrt4

user32

comdlg32

advapi32

ole32

oleaut32

crypt32

shlwapi

ws2_32

iphlpapi

dnsapi

netapi32

wininet

msimg32

Sections

.text Size: - Virtual size: 2.5MB

.rdata Size: - Virtual size: 560KB

.data Size: - Virtual size: 62KB

.gfids Size: - Virtual size: 5KB

.tls Size: 512B - Virtual size: 512B

.text Size: - Virtual size: 1.1MB

.data Size: - Virtual size: 83KB

Size: 30KB - Virtual size: 30KB

.reloc Size: 512B - Virtual size: 328B

.rsrc Size: 4.4MB - Virtual size: 4.4MB

.text
Size: - Virtual size: 2.5MB

.rdata
Size: - Virtual size: 560KB

.data
Size: - Virtual size: 62KB

.gfids
Size: - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 512B

.text
Size: - Virtual size: 1.1MB

.data
Size: - Virtual size: 83KB

.reloc
Size: 512B - Virtual size: 328B

.rsrc
Size: 4.4MB - Virtual size: 4.4MB