a3290bd489ad06f42e3403f8d160f35b1de76d9095d294d4d3ab8ce5a3105735

Sharing

Copy URL Twitter E-mail

General

Target

a3290bd489ad06f42e3403f8d160f35b1de76d9095d294d4d3ab8ce5a3105735
Size

144KB
MD5

a4d961e2e9f28d5ef782d0096237711a
SHA1

d1eb825efb52b83bfc380b63b7d7dc3ac76934ad
SHA256

a3290bd489ad06f42e3403f8d160f35b1de76d9095d294d4d3ab8ce5a3105735
SHA512

4d5b12c584ad4fa0376ab2cc71a1c5ecc01b772e5faf73e5c5e918f978778ce83feb7155dc259c60b610b694e0f395720f1257a0818803e060deb47a545cadae
SSDEEP

3072:x/o3Eo3Vo37o3K0To34C/o3vo3zo34C/o39o3ho3Fo34co36o3ENAto35o3LrpoU:+NAj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3290bd489ad06f42e3403f8d160f35b1de76d9095d294d4d3ab8ce5a3105735

Files

a3290bd489ad06f42e3403f8d160f35b1de76d9095d294d4d3ab8ce5a3105735
.exe windows:6 windows x86 arch:x86

778a774b5fa0212321f917fb40bea08d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteExW

user32

LoadStringW

ucrtbase

__acrt_iob_func
__p___argc
__p___wargv
__stdio_common_vsprintf
__stdio_common_vswprintf
_configure_wide_argv
_get_initial_wide_environment
_initialize_wide_environment
_set_app_type
_strdup
_wcsdup
exit
free
fwrite
getenv
malloc
memcpy
memmove
memset
strchr
strcmp
strcpy
strcspn
strlen
wcschr
wcscpy
wcslen
wcspbrk
wcsrchr

kernel32

AssignProcessToJobObject
CompareStringW
CreateJobObjectA
CreateProcessW
ExitProcess
FindClose
FindFirstFileW
FormatMessageW
GetBinaryTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFullPathNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetStdHandle
GetTickCount
HeapAlloc
HeapReAlloc
InitializeProcThreadAttributeList
IsBadStringPtrW
LocalFree
SetConsoleCtrlHandler
SetInformationJobObject
UpdateProcThreadAttribute
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile

ntdll

_chkstk
_vsnprintf

Exports

Exports

__wine_dbg_get_channel_flags
__wine_dbg_header
__wine_dbg_output
__wine_dbg_strdup

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

778a774b5fa0212321f917fb40bea08d

Headers

DLL Characteristics

File Characteristics

Imports

shell32

user32

ucrtbase

kernel32

ntdll

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 288B

.rsrc Size: 104KB - Virtual size: 102KB

.reloc Size: 4KB - Virtual size: 920B

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 288B

.rsrc
Size: 104KB - Virtual size: 102KB

.reloc
Size: 4KB - Virtual size: 920B