fbf407c19b1c9b1b773afa2d83663f76afef5376693040582614543762ce9926

Sharing

Copy URL Twitter E-mail

General

Target

fbf407c19b1c9b1b773afa2d83663f76afef5376693040582614543762ce9926
Size

1.0MB
MD5

626975770769ef69bb9b7053347f081e
SHA1

2f7388f374f9cf329b2353ae14c2fa8fa2852053
SHA256

fbf407c19b1c9b1b773afa2d83663f76afef5376693040582614543762ce9926
SHA512

dff88c3ef6d07e8709c0ea27e0c44e5c5a341cd8f61e24557e905076aa6602e4554a8f141b76541e8e9cfc3bb6ef1d13f241f419b5d8351187bba7ff7ef05859
SSDEEP

12288:QrmHktSo1ip79RRgp+s/yWpY52ly2FNcsErwjzojpiLCmsGTpLysqufDlz6lbVl:Qqc1iZvRgpvhly/rw/OQeCTp2spxYbV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbf407c19b1c9b1b773afa2d83663f76afef5376693040582614543762ce9926

Files

fbf407c19b1c9b1b773afa2d83663f76afef5376693040582614543762ce9926
.exe windows:5 windows x86

6d5d07bb7b69fc245fcf79ca501182d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
MessageBoxA

ole32

CoUninitialize
CoInitializeEx
CLSIDFromString
CoGetObject

oleaut32

SysAllocString
VariantInit
SysFreeString
VariantClear

kernel32

HeapReAlloc
SetFilePointerEx
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
DecodePointer
OpenProcess
TerminateProcess
RaiseException
CreateThread
GetCurrentThreadId
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WriteFile
CloseHandle
GetTickCount
lstrcmpiA
ExpandEnvironmentStringsA
CreateDirectoryA
CreateFileA
GetFileAttributesA
MultiByteToWideChar
HeapSize
Process32First
Process32Next
InterlockedDecrement
GetProcAddress
LocalAlloc
GetCurrentProcess
GetCurrentProcessId
ReadProcessMemory
FormatMessageA
GetModuleFileNameW
GetModuleHandleA
GetWindowsDirectoryW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
EncodePointer
CreateFileW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
OutputDebugStringW
FindNextFileA
WriteConsoleW
CreateToolhelp32Snapshot
SetLastError
FindFirstFileExA
FindClose
EnumSystemLocalesW
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
HeapFree
HeapAlloc
GetFileType
IsValidLocale
GetUserDefaultLCID

advapi32

OpenProcessToken
GetTokenInformation

shell32

SHGetSpecialFolderPathA

shlwapi

SHSetValueA

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 784KB - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d5d07bb7b69fc245fcf79ca501182d7

Headers

DLL Characteristics

File Characteristics

Imports

user32

ole32

oleaut32

kernel32

advapi32

shell32

shlwapi

Sections

.text Size: 135KB - Virtual size: 135KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 784KB - Virtual size: 787KB

.rsrc Size: 41KB - Virtual size: 40KB

.text
Size: 135KB - Virtual size: 135KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 784KB - Virtual size: 787KB

.rsrc
Size: 41KB - Virtual size: 40KB