0b45d8bcf1c4e95cdb4555444117b66bb4620fdd23ed738a579b0cf8c956d891

Sharing

Copy URL

Twitter E-mail

General

Target

0b45d8bcf1c4e95cdb4555444117b66bb4620fdd23ed738a579b0cf8c956d891
Size

14.4MB
MD5

68b90e46d6c14b2490556bbe1f002140
SHA1

9d192d03401e7b0631f5292a312499c54947a3b1
SHA256

0b45d8bcf1c4e95cdb4555444117b66bb4620fdd23ed738a579b0cf8c956d891
SHA512

478293fac3a2fc6415b44f45d1fca7556bd9ccda79f77e732d758ab4e11791e60a9981764f927d87007abce907b29fc294eb9972574e323616400a8ac04cb48d
SSDEEP

3072:IIRM2+nBReUCNR+fpBIJPjpzuRoiNsIRM2+nBReUCNR+kmEb:/K2+nB4NPjniNrK2+nB4NL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b45d8bcf1c4e95cdb4555444117b66bb4620fdd23ed738a579b0cf8c956d891

Files

0b45d8bcf1c4e95cdb4555444117b66bb4620fdd23ed738a579b0cf8c956d891
.exe windows:5 windows x86

f83046692259972fe3d627b65f43622e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlen
LoadLibraryA
OpenFileMappingA
FindFirstFileA
lstrlen
HeapAlloc
CreateFileW
GetStringTypeA
FileTimeToSystemTime
HeapAlloc
lstrlen
WriteConsoleA
WaitNamedPipeW
GetSystemDirectoryA
GetCurrentProcess
AllocConsole
GetFileAttributesA
GetLocalTime
CreateFileMappingW
LoadLibraryExA
GetVersionExA
GetSystemDirectoryA
ReadFile
GetProcAddress

shlwapi

PathCompactPathA
UrlIsNoHistoryW
UrlCanonicalizeA
UrlGetLocationA
UrlEscapeW
UrlGetPartA
SHDeleteKeyA
UrlHashA
PathCombineW
PathCommonPrefixW
PathIsRootA
UrlCompareW

user32

DialogBoxParamA
LoadBitmapW
IsDialogMessageA
IsCharLowerA
LoadMenuW
GetClassLongW
GetMessageA
PostMessageA
wsprintfW
PeekMessageW
CharToOemW
GetPropA

resutils

ClusWorkerStart
ResUtilDupString

cfgmgr32

CM_Add_Empty_Log_Conf
CM_Add_IDA
CMP_Report_LogOn

comsvcs

SafeRef
RecycleSurrogate
CoEnterServiceDomain
CoLoadServices

authz

AuthzFreeResourceManager
AuthzFreeAuditEvent

advapi32

RegReplaceKeyA
ReadEventLogA
RegCreateKeyExW
RegSaveKeyA
RegOpenKeyA
RegDeleteValueA
RegEnumKeyW
OpenEventLogA
LogonUserW
GetUserNameA
CreateServiceW

Exports

Exports

namkers

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.jsdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wdata
Size: 1024B - Virtual size: 962B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14.3MB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f83046692259972fe3d627b65f43622e

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

resutils

cfgmgr32

comsvcs

authz

advapi32

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 123KB

.jsdata Size: 12KB - Virtual size: 12KB

.wdata Size: 1024B - Virtual size: 962B

.rsrc Size: 14.3MB - Virtual size: 1KB

.text
Size: 124KB - Virtual size: 123KB

.jsdata
Size: 12KB - Virtual size: 12KB

.wdata
Size: 1024B - Virtual size: 962B

.rsrc
Size: 14.3MB - Virtual size: 1KB