1173b374bba5c87b6c76f83a43dbec62c2710a9069a63c51d66e75f74c336901

Sharing

Copy URL Twitter E-mail

General

Target

1173b374bba5c87b6c76f83a43dbec62c2710a9069a63c51d66e75f74c336901
Size

12.6MB
MD5

16c21b8766bb7a54739f39513f869ad7
SHA1

1d3253cbbd69cc80d246ee6f20712f546d683e5d
SHA256

1173b374bba5c87b6c76f83a43dbec62c2710a9069a63c51d66e75f74c336901
SHA512

4291a173711bb8aeecfdb69da51034487dd2545d1062eacc20ba58bdd7dfbb1e0d67eae291d80edadeab2cd3ad62f8ebf56232e536f92667fc291767161cd362
SSDEEP

3072:OIRM2+nBReUCNR+fpBIJPjpzuRoiNsIRM2+nBReUCNR+kmEb:5K2+nB4NPjniNrK2+nB4NL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1173b374bba5c87b6c76f83a43dbec62c2710a9069a63c51d66e75f74c336901

Files

1173b374bba5c87b6c76f83a43dbec62c2710a9069a63c51d66e75f74c336901
.exe windows:5 windows x86

f83046692259972fe3d627b65f43622e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlen
LoadLibraryA
OpenFileMappingA
FindFirstFileA
lstrlen
HeapAlloc
CreateFileW
GetStringTypeA
FileTimeToSystemTime
HeapAlloc
lstrlen
WriteConsoleA
WaitNamedPipeW
GetSystemDirectoryA
GetCurrentProcess
AllocConsole
GetFileAttributesA
GetLocalTime
CreateFileMappingW
LoadLibraryExA
GetVersionExA
GetSystemDirectoryA
ReadFile
GetProcAddress

shlwapi

PathCompactPathA
UrlIsNoHistoryW
UrlCanonicalizeA
UrlGetLocationA
UrlEscapeW
UrlGetPartA
SHDeleteKeyA
UrlHashA
PathCombineW
PathCommonPrefixW
PathIsRootA
UrlCompareW

user32

DialogBoxParamA
LoadBitmapW
IsDialogMessageA
IsCharLowerA
LoadMenuW
GetClassLongW
GetMessageA
PostMessageA
wsprintfW
PeekMessageW
CharToOemW
GetPropA

resutils

ClusWorkerStart
ResUtilDupString

cfgmgr32

CM_Add_Empty_Log_Conf
CM_Add_IDA
CMP_Report_LogOn

comsvcs

SafeRef
RecycleSurrogate
CoEnterServiceDomain
CoLoadServices

authz

AuthzFreeResourceManager
AuthzFreeAuditEvent

advapi32

RegReplaceKeyA
ReadEventLogA
RegCreateKeyExW
RegSaveKeyA
RegOpenKeyA
RegDeleteValueA
RegEnumKeyW
OpenEventLogA
LogonUserW
GetUserNameA
CreateServiceW

Exports

Exports

namkers

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.jsdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wdata
Size: 1024B - Virtual size: 962B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12.4MB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f83046692259972fe3d627b65f43622e

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

resutils

cfgmgr32

comsvcs

authz

advapi32

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 123KB

.jsdata Size: 12KB - Virtual size: 12KB

.wdata Size: 1024B - Virtual size: 962B

.rsrc Size: 12.4MB - Virtual size: 1KB

.text
Size: 124KB - Virtual size: 123KB

.jsdata
Size: 12KB - Virtual size: 12KB

.wdata
Size: 1024B - Virtual size: 962B

.rsrc
Size: 12.4MB - Virtual size: 1KB