d35374c9e44e84003ddd6582d0397474036082b3dc2663603ce22a6217f3ae96

General

Target

d35374c9e44e84003ddd6582d0397474036082b3dc2663603ce22a6217f3ae96
Size

4.8MB
MD5

33ca4d9093ebd26ef02db9e0a6f8e547
SHA1

4379c202b5a004219256497baea6641e582cc69b
SHA256

d35374c9e44e84003ddd6582d0397474036082b3dc2663603ce22a6217f3ae96
SHA512

ae08a57769b153be35d74759f3d9bf1fd422760cbbd61ad1d33741f6b3826cae035b76dc727bfad5408fa70208af9699accb0cf580b0cf03b2023c3a9c182ee7
SSDEEP

98304:nWpiM8rIUs8xPYgglNeODs/Fuqg2xP/VSzJCmY+fEay:WMXrNPg+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d35374c9e44e84003ddd6582d0397474036082b3dc2663603ce22a6217f3ae96

Files

d35374c9e44e84003ddd6582d0397474036082b3dc2663603ce22a6217f3ae96
.exe windows:5 windows x86

c3803752167a683f3dbd2e2ab3d19b6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

powrprof

IsPwrHibernateAllowed
ReadGlobalPwrPolicy

kernel32

LoadLibraryExW
LocalFree
GetCurrentConsoleFont
AddConsoleAliasA
HeapWalk
HeapCreate
EraseTape
EnumSystemLocalesA
GetModuleHandleW
GetProcessAffinityMask
SetFileAttributesW
DeleteVolumeMountPointW
LockFile
GetLocaleInfoW
FillConsoleOutputAttribute
GetConsoleCursorInfo
GlobalFindAtomA
GetProcAddress
LoadLibraryA
GetModuleHandleA
GlobalAddAtomW
FindFirstFileA

wininet

RetrieveUrlCacheEntryStreamW

msvcrt

memset

user32

GetWindowRect
InsertMenuA
GetClipboardFormatNameA
SetCursor
ShowCaret
IsWindow

ole32

CoFreeUnusedLibrariesEx

gdi32

GetDeviceCaps
GetObjectW
GetCharWidthW
GetPaletteEntries
GetBitmapBits

winspool.drv

FindNextPrinterChangeNotification

Sections

.rda
Size: 304KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.m5Fih
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3803752167a683f3dbd2e2ab3d19b6d

Headers

DLL Characteristics

File Characteristics

Imports

powrprof

kernel32

wininet

msvcrt

user32

ole32

gdi32

winspool.drv

Sections

.rda Size: 304KB - Virtual size: 300KB

.rdata Size: 4KB - Virtual size: 3KB

.data1 Size: 20KB - Virtual size: 28KB

.m5Fih Size: 4KB - Virtual size: 864B

.reloc Size: 4KB - Virtual size: 1KB

.rda
Size: 304KB - Virtual size: 300KB

.rdata
Size: 4KB - Virtual size: 3KB

.data1
Size: 20KB - Virtual size: 28KB

.m5Fih
Size: 4KB - Virtual size: 864B

.reloc
Size: 4KB - Virtual size: 1KB