bbd8c47de769d4a8f6ccd4f1d5a4bf8de492baf30c11b5de136a99344c71e122

Sharing

Copy URL Twitter E-mail

General

Target

bbd8c47de769d4a8f6ccd4f1d5a4bf8de492baf30c11b5de136a99344c71e122
Size

11.1MB
MD5

ea78823808ae115ad72b201c354df2c3
SHA1

1060361a852c2dd295e429332f05862b403c639f
SHA256

bbd8c47de769d4a8f6ccd4f1d5a4bf8de492baf30c11b5de136a99344c71e122
SHA512

02246e782cbcf027fc0d4a0ed79e38924818f6cfeba5648f3be811295901d96a583b0fde5db07cdca347ccd2a76e8837c9bd2d25b0240a2e5e045931844ba1e8
SSDEEP

196608:SlnV33BTLJX9rudrBCtIeq6hpADd5ldqhSBS8fM330hV2kjsNVLZ3ORXCmRnLLln:SlXZZudrItPq6hpAnlAhSBfhb+CVRLLd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bbd8c47de769d4a8f6ccd4f1d5a4bf8de492baf30c11b5de136a99344c71e122

Files

bbd8c47de769d4a8f6ccd4f1d5a4bf8de492baf30c11b5de136a99344c71e122
.exe windows:4 windows x64 arch:x64

80a2d4c1cf47973a3f00237384fe5046

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CopyFileW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindResourceA
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetCurrentProcessId
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessId
GetStartupInfoW
GetSystemTimeAsFileTime
GetTempPathW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadResource
LockResource
MapViewOfFile
MultiByteToWideChar
ReadFile
SetConsoleCtrlHandler
SetEnvironmentVariableA
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wargv
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
_wcmdln
_wcsdup
_wcsicmp
_wrename
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
mbstowcs
memcpy
memmove
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcscmp
wcslen
wcsncmp

shell32

SHFileOperationW
SHGetFolderPathW

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

user32

GetWindow

advapi32

RegSetValueExA

Sections

.text
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80a2d4c1cf47973a3f00237384fe5046

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

shell32

iphlpapi

psapi

user32

advapi32

Sections

.text Size: 9.7MB - Virtual size: 9.7MB

.sedata Size: 1.4MB - Virtual size: 1.4MB

.idata Size: 3KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 9.7MB - Virtual size: 9.7MB

.sedata
Size: 1.4MB - Virtual size: 1.4MB

.idata
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB