b00e4f39ac6d8764d5a5b21e8ba726facfcd8333d8cac006295faa94b74c8ea4

Sharing

Copy URL Twitter E-mail

General

Target

b00e4f39ac6d8764d5a5b21e8ba726facfcd8333d8cac006295faa94b74c8ea4
Size

1.0MB
MD5

9c6f6b617d59b7880751a232be4bd37c
SHA1

34af33c1afc5a52f9566bcf373f5f495c0c2e4bf
SHA256

b00e4f39ac6d8764d5a5b21e8ba726facfcd8333d8cac006295faa94b74c8ea4
SHA512

dd7997376270409c474679c6f2254e3ff495ae39ad6a5a48337586fecdfcfd6c0c73bb7d9a313f4926dcdc33388bc366243e4d6cfe04e9a53e79ad8122a612bd
SSDEEP

12288:qv7htC3NDT29RRgp+s/yWpY52ly2FNcsErwjzojpiLCmsGTpLyNqufDIz6lbVl:qINDCvRgpvhly/rw/OQeCTp2Np0YbV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b00e4f39ac6d8764d5a5b21e8ba726facfcd8333d8cac006295faa94b74c8ea4

Files

b00e4f39ac6d8764d5a5b21e8ba726facfcd8333d8cac006295faa94b74c8ea4
.exe windows:5 windows x86

6d5d07bb7b69fc245fcf79ca501182d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
MessageBoxA

ole32

CoUninitialize
CoInitializeEx
CLSIDFromString
CoGetObject

oleaut32

SysAllocString
VariantInit
SysFreeString
VariantClear

kernel32

HeapReAlloc
SetFilePointerEx
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
DecodePointer
OpenProcess
TerminateProcess
RaiseException
CreateThread
GetCurrentThreadId
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WriteFile
CloseHandle
GetTickCount
lstrcmpiA
ExpandEnvironmentStringsA
CreateDirectoryA
CreateFileA
GetFileAttributesA
MultiByteToWideChar
HeapSize
Process32First
Process32Next
InterlockedDecrement
GetProcAddress
LocalAlloc
GetCurrentProcess
GetCurrentProcessId
ReadProcessMemory
FormatMessageA
GetModuleFileNameW
GetModuleHandleA
GetWindowsDirectoryW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
EncodePointer
CreateFileW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
OutputDebugStringW
FindNextFileA
WriteConsoleW
CreateToolhelp32Snapshot
SetLastError
FindFirstFileExA
FindClose
EnumSystemLocalesW
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
HeapFree
HeapAlloc
GetFileType
IsValidLocale
GetUserDefaultLCID

advapi32

OpenProcessToken
GetTokenInformation

shell32

SHGetSpecialFolderPathA

shlwapi

SHSetValueA

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 784KB - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d5d07bb7b69fc245fcf79ca501182d7

Headers

DLL Characteristics

File Characteristics

Imports

user32

ole32

oleaut32

kernel32

advapi32

shell32

shlwapi

Sections

.text Size: 135KB - Virtual size: 135KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 784KB - Virtual size: 787KB

.rsrc Size: 41KB - Virtual size: 40KB

.text
Size: 135KB - Virtual size: 135KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 784KB - Virtual size: 787KB

.rsrc
Size: 41KB - Virtual size: 40KB