6b31384ca7596c336e2edb123fded3c42cb35a158d6d115e93e9be9d3678e13f

Sharing

Copy URL Twitter E-mail

General

Target

6b31384ca7596c336e2edb123fded3c42cb35a158d6d115e93e9be9d3678e13f
Size

315KB
MD5

60fb53f6ec2f7a33a976706ddb78373e
SHA1

af516d0e87c985819a7364ffea38152aa5d37b9a
SHA256

6b31384ca7596c336e2edb123fded3c42cb35a158d6d115e93e9be9d3678e13f
SHA512

e9c0728c18a2a71656536166842e3f93967991567abc464cf396d8b643aeccf780e98d364eaefc0f5d9160906b1ca057cfa5b563a0663152c442acefa5ffe171
SSDEEP

6144:tXtHE/eEVV/bcaCNgCzTQ7ZGZJkcUkFyKV:tdHCeK/PggS87KlU/KV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b31384ca7596c336e2edb123fded3c42cb35a158d6d115e93e9be9d3678e13f

Files

6b31384ca7596c336e2edb123fded3c42cb35a158d6d115e93e9be9d3678e13f
.exe windows:4 windows x86

378a6957a81dfaa9f4c53415b2c15ae6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
Sleep
LockResource
CloseHandle
LoadResource
OpenProcess
GetExitCodeThread
GetModuleHandleW
TerminateThread
FindResourceExW
GetProcAddress
GetCurrentProcessId
GetLastError
MultiByteToWideChar
GetCommandLineW
WideCharToMultiByte
WriteFile
ReadFile
WritePrivateProfileStringW
GetFileType
SetHandleCount
SetEnvironmentVariableA
CompareStringW
CompareStringA
InterlockedDecrement
LoadLibraryW
FindResourceW
GetModuleFileNameW
GetSystemDirectoryW
CreateFileA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
LoadLibraryA
SetFilePointer
FlushFileBuffers
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetModuleFileNameA
GetStdHandle
VirtualAlloc
VirtualFree
HeapCreate
GetDateFormatA
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeFormatA
GetTickCount
QueryPerformanceCounter
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
InterlockedIncrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetOEMCP
IsValidCodePage

user32

GetWindowThreadProcessId
UnregisterClassA
FindWindowExW
PostMessageW
FindWindowW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoUninitialize
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CLSIDFromString
CoInitialize
CoCreateInstance

oleaut32

VariantClear
VarUdateFromDate
VariantInit
SysFreeString
SafeArrayDestroy
VarBstrFromCy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
SysAllocString

shlwapi

PathRemoveFileSpecW
PathAppendW
StrToIntW

psapi

GetModuleFileNameExW

Sections

.text
Size: 184KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

378a6957a81dfaa9f4c53415b2c15ae6

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

psapi

Sections

.text Size: 184KB - Virtual size: 180KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 80KB - Virtual size: 80KB

.text
Size: 184KB - Virtual size: 180KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 80KB - Virtual size: 80KB