8842145147b4735a4d88ad5c4d4be80eb0f3e8fbcf01c7916701e78a61eacb19

Sharing

Copy URL Twitter E-mail

General

Target

8842145147b4735a4d88ad5c4d4be80eb0f3e8fbcf01c7916701e78a61eacb19
Size

270KB
MD5

1435ce94955ee53c3b2ba9ef4a3f57f6
SHA1

023ec5d6a97cd46cdd0fc7b3b419079c44ae948e
SHA256

8842145147b4735a4d88ad5c4d4be80eb0f3e8fbcf01c7916701e78a61eacb19
SHA512

2b311d1b5fae8286b66eedc761e55e622ad8cad41cb85e05f667251e48e832e714a084afbb9f06f7c9fcf3b56d187dbd34ff0a2de9244bd70046d9ed7023d26c
SSDEEP

3072:ZKoCVsOPMPStynz6WkEWnD+/SQznL+nVHQ+HJVhg5QWYv35+pcoY46qGQCCL8/HM:ZyJPnAnWWkLD+/PznCDHJE5uPohlcHM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8842145147b4735a4d88ad5c4d4be80eb0f3e8fbcf01c7916701e78a61eacb19

Files

8842145147b4735a4d88ad5c4d4be80eb0f3e8fbcf01c7916701e78a61eacb19
.exe windows:6 windows x64 arch:x64

c5cdf22ac21b1818bdbada16fd83851f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptDeriveKey
CryptDestroyKey
CryptDecrypt
CryptCreateHash
CryptHashData
CryptDestroyHash

kernel32

HeapCreate
HeapAlloc
Sleep
SwitchToFiber
CreateFiber
ConvertThreadToFiber
WideCharToMultiByte
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
FreeLibrary
LoadLibraryExW
GetConsoleCP
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
CloseHandle
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
CreateFileW
GetConsoleMode
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
ReadConsoleW
FlushFileBuffers
ReadFile
GetFileSizeEx
SetFilePointerEx
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
RtlUnwind

Sections

.text
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5cdf22ac21b1818bdbada16fd83851f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 162KB - Virtual size: 162KB

.rdata Size: 89KB - Virtual size: 89KB

.data Size: 4KB - Virtual size: 11KB

.pdata Size: 9KB - Virtual size: 8KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 162KB - Virtual size: 162KB

.rdata
Size: 89KB - Virtual size: 89KB

.data
Size: 4KB - Virtual size: 11KB

.pdata
Size: 9KB - Virtual size: 8KB

.reloc
Size: 3KB - Virtual size: 3KB