4c4f7d1029d4750b3cefde3ed61399d9

General

Target

4c4f7d1029d4750b3cefde3ed61399d9
Size

12KB
MD5

4c4f7d1029d4750b3cefde3ed61399d9
SHA1

703bd2db56ae3bda4e966956f8e70465e1f3e557
SHA256

2b8f6cdadd2fbcac721300a46534e600f76908c1e456b8750fa48a063df39a01
SHA512

e61ae53265beae14e3b234aa18dd4ffe78bd003dc1b4cdb9cbe3a3f000a7ec7030115b19e5133a459340ee738dafbe3adf7fd1a1ce2aa0464dd3ba16ba39e169
SSDEEP

384:7Jh43TTW/3Rfg+lrvfONkvZnEc5WtI0a5G:774jSPRnrvXxN56ING

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c4f7d1029d4750b3cefde3ed61399d9

Files

4c4f7d1029d4750b3cefde3ed61399d9
.exe windows:4 windows x86 arch:x86

e7a8b7f32b94428c9b3c76d3959f1fb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
WriteFile
SetFilePointer
CreateFileA
ExitProcess
lstrcmpiA
Sleep
lstrlenA
GetModuleFileNameA
CreateEventA
DeleteFileA
GetTempPathA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CloseHandle
lstrcpyA
WinExec
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
IsDebuggerPresent

user32

wsprintfA

advapi32

OpenProcessToken
DuplicateTokenEx
CreateProcessAsUserA

msvcr80

rand
atoi
memcpy
memset
strncpy_s
_crt_debugger_hook
strchr
strstr
srand

ws2_32

gethostbyname
setsockopt
WSAEventSelect
recv
WSAStartup
inet_addr
htons
shutdown
connect
closesocket
inet_ntoa
WSACleanup
socket
gethostname
send

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7a8b7f32b94428c9b3c76d3959f1fb5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcr80

ws2_32

userenv

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 428B

.vmp0 Size: 4KB - Virtual size: 3KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 428B

.vmp0
Size: 4KB - Virtual size: 3KB