198e3c9e6f3dbcf586ac90486187ebfffdeb1c5d663131fc60c45451b04cce7a

Sharing

Copy URL Twitter E-mail

General

Target

198e3c9e6f3dbcf586ac90486187ebfffdeb1c5d663131fc60c45451b04cce7a
Size

1.8MB
MD5

1fa011e6a692ee95452c626e61b5263a
SHA1

c1a97056f5dcf476062ca75b769ebcf7b0815575
SHA256

198e3c9e6f3dbcf586ac90486187ebfffdeb1c5d663131fc60c45451b04cce7a
SHA512

4609a28e8b49fc37b3db14c4b9df4137740ea43f0471244c1f851fd9d22b9abc83e22437b06c7212f45299f524a71f864001e4b411075ec5fb88d1ad7356e151
SSDEEP

49152:1P0z7+WlQzoq/A9SfIIks19akfLlSNUGmO3rIOMIs6Wa5C:we5Y9GII/19dlSTTUjIVWa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
198e3c9e6f3dbcf586ac90486187ebfffdeb1c5d663131fc60c45451b04cce7a

Files

198e3c9e6f3dbcf586ac90486187ebfffdeb1c5d663131fc60c45451b04cce7a
.exe windows:5 windows x86

852a09940e2b099ce4e8af070cb40884

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
MoveFileW
CloseHandle
WriteFile
CreateFileW
GetModuleFileNameW
GetTempFileNameW
GetTempPathW
WaitForMultipleObjects
Thread32Next
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
Sleep
CreateDirectoryW
TerminateProcess
GetCurrentProcess
VirtualFree
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleW
WriteConsoleW
SetStdHandle
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetLastError
HeapFree
RtlUnwind
RaiseException
HeapAlloc
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
HeapReAlloc
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers

shell32

ShellExecuteW

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

852a09940e2b099ce4e8af070cb40884

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

Sections

.text Size: 138KB - Virtual size: 138KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 138KB - Virtual size: 138KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 7KB - Virtual size: 7KB