5de78e8c6e6c1a78c7e050463fed9a0349f43c070bb39a4d7042a6ced5a4a7a5

Sharing

Copy URL Twitter E-mail

General

Target

5de78e8c6e6c1a78c7e050463fed9a0349f43c070bb39a4d7042a6ced5a4a7a5
Size

1.0MB
MD5

8759b57d5e4dea87d9785d41f6c3b157
SHA1

4bde9b08572574ec3c0bca9ea00e0924a90e7415
SHA256

5de78e8c6e6c1a78c7e050463fed9a0349f43c070bb39a4d7042a6ced5a4a7a5
SHA512

638286dd9c2ee695d4c7debbd0bc57b6437140ac1c9488ffd16101399d0f01f74015782169ff413057222b3347164a07098116bdc57f1dc633403edaba9eeb0e
SSDEEP

12288:imEXtQbkOQ49RRgp+s/yWpY52ly2FNcsErwjzojpiLCmsGPkLyRN5ZqufDHz6lbH:iKkOLvRgpvhly/rw/OQeCsLyXjpLYbV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5de78e8c6e6c1a78c7e050463fed9a0349f43c070bb39a4d7042a6ced5a4a7a5

Files

5de78e8c6e6c1a78c7e050463fed9a0349f43c070bb39a4d7042a6ced5a4a7a5
.exe windows:5 windows x86

6d5d07bb7b69fc245fcf79ca501182d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
MessageBoxA

ole32

CoUninitialize
CoInitializeEx
CLSIDFromString
CoGetObject

oleaut32

SysAllocString
VariantInit
SysFreeString
VariantClear

kernel32

HeapReAlloc
SetFilePointerEx
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
DecodePointer
OpenProcess
TerminateProcess
RaiseException
CreateThread
GetCurrentThreadId
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WriteFile
CloseHandle
GetTickCount
lstrcmpiA
ExpandEnvironmentStringsA
CreateDirectoryA
CreateFileA
GetFileAttributesA
MultiByteToWideChar
HeapSize
Process32First
Process32Next
InterlockedDecrement
GetProcAddress
LocalAlloc
GetCurrentProcess
GetCurrentProcessId
ReadProcessMemory
FormatMessageA
GetModuleFileNameW
GetModuleHandleA
GetWindowsDirectoryW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
EncodePointer
CreateFileW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
OutputDebugStringW
FindNextFileA
WriteConsoleW
CreateToolhelp32Snapshot
SetLastError
FindFirstFileExA
FindClose
EnumSystemLocalesW
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
HeapFree
HeapAlloc
GetFileType
IsValidLocale
GetUserDefaultLCID

advapi32

OpenProcessToken
GetTokenInformation

shell32

SHGetSpecialFolderPathA

shlwapi

SHSetValueA

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 784KB - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d5d07bb7b69fc245fcf79ca501182d7

Headers

DLL Characteristics

File Characteristics

Imports

user32

ole32

oleaut32

kernel32

advapi32

shell32

shlwapi

Sections

.text Size: 135KB - Virtual size: 135KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 784KB - Virtual size: 787KB

.rsrc Size: 41KB - Virtual size: 40KB

.text
Size: 135KB - Virtual size: 135KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 784KB - Virtual size: 787KB

.rsrc
Size: 41KB - Virtual size: 40KB