0aa3e8aa8dad03366088fab8155bdc77

Sharing

Copy URL Twitter E-mail

General

Target

0aa3e8aa8dad03366088fab8155bdc77
Size

653KB
MD5

0aa3e8aa8dad03366088fab8155bdc77
SHA1

a5e69db2b3c22e20998a33d1b752ba02562e1121
SHA256

cc026bca69491a4ebe8441a9cdb7aa165748c085fec952becee41a7e0a1a489e
SHA512

8a345743156d88f3630c380f0e3a2e11084cf061118cf10a9062b5cf826c7a2ae0baae3558f9e90f46f97dd7b87ac225df55bac70d9fdd7918098131a682fb35
SSDEEP

12288:3mxkkFk/21AzNZcMhyYYkojMRcvDmoDybUNI/m5rRCSJXBAIxO+Dh:3mxe3zNByXkoIR+DmuIEcSJXRxO8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0aa3e8aa8dad03366088fab8155bdc77

Files

0aa3e8aa8dad03366088fab8155bdc77
.exe windows:5 windows x86 arch:x86

452a573570b57080deb33a6b6e9df7c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapReAlloc
lstrlenA
GetLocaleInfoA
EndUpdateResourceW
GetQueuedCompletionStatus
ReadConsoleA
GetCurrentProcess
SetEvent
BackupSeek
GetConsoleTitleA
WriteFile
InitializeCriticalSection
GetEnvironmentStrings
InitAtomTable
HeapDestroy
GetFileAttributesA
FindNextVolumeW
IsProcessorFeaturePresent
GetTapePosition
WriteConsoleW
GetModuleFileNameW
DeactivateActCtx
InterlockedExchange
GetProcAddress
BeginUpdateResourceW
GetProcessVersion
LocalAlloc
RemoveDirectoryW
SetConsoleWindowInfo
GetModuleHandleA
VirtualProtect
SetProcessShutdownParameters
ReleaseMutex
GetCurrentProcessId
FindNextVolumeA
lstrcpyA
ReadFile
GetProcessHeap
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetCPInfo
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
HeapCreate
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
SetFilePointer
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CloseHandle
CreateFileA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LoadLibraryW
SetEndOfFile
CreateFileW

Exports

Exports

@GetFirstVice@8
@SetViceVariants@12

Sections

.text
Size: 558KB - Virtual size: 558KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 39.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rog
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.faka
Size: 512B - Virtual size: 23B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

452a573570b57080deb33a6b6e9df7c8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 558KB - Virtual size: 558KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 9KB - Virtual size: 39.2MB

.rog Size: 1024B - Virtual size: 624B

.faka Size: 512B - Virtual size: 23B

.rsrc Size: 59KB - Virtual size: 59KB

.text
Size: 558KB - Virtual size: 558KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 9KB - Virtual size: 39.2MB

.rog
Size: 1024B - Virtual size: 624B

.faka
Size: 512B - Virtual size: 23B

.rsrc
Size: 59KB - Virtual size: 59KB