505977ec206f983f6e14d1c7f33879ba

Sharing

Copy URL

Twitter E-mail

General

Target

505977ec206f983f6e14d1c7f33879ba
Size

11.9MB
MD5

505977ec206f983f6e14d1c7f33879ba
SHA1

19c1bf887634069c8963df99c838e698c413437f
SHA256

329dc01d0480119891a2c437a8bb2c9b2315b1c2d44bfbe54cd2d4b93982ee06
SHA512

73da026c0f642d872e62d09c8410d5b035b811076eed46f5145e8f90e75e8a2651224d2418ff888e4e526083415e9dca647589b7200666e2c2bf1eb5fc429eb7
SSDEEP

6144:QM7q8RJgcdyozssssssssssssssssssssssssssssssssssssssssssssssssssL:Qlkh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
505977ec206f983f6e14d1c7f33879ba

Files

505977ec206f983f6e14d1c7f33879ba
.exe windows:5 windows x86 arch:x86

73d8a8cfb02b3dec1afcf0551350983a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

nddeapi

NDdeShareAddA
NDdeShareGetInfoA
NDdeShareEnumA
NDdeShareSetInfoA

certcli

CACloseCertType
CACloseCA
CADeleteCA
CAEnumFirstCA

crypt32

CertCreateContext
CertCompareCertificate
CertFindChainInStore
CertFindAttribute
CertFindExtension
CryptEnumOIDInfo
CertCloseStore
CertDuplicateStore
CertGetNameStringA
CertOpenStore
CertDuplicateCRLContext
CertSaveStore
CertDeleteCRLFromStore

kernel32

GetModuleHandleA
WaitNamedPipeA
CreateDirectoryA
EnterCriticalSection
lstrcmp
lstrcmp
CreateMutexA
IsBadStringPtrA
FindFirstFileA
FileTimeToLocalFileTime
LoadLibraryW
LoadLibraryExW
GetProcAddress
lstrcmp
lstrcmp
lstrcmp

shlwapi

PathIsRootA
UrlIsA
PathCommonPrefixA
UrlGetPartA
UrlGetLocationA
UrlEscapeA
UrlHashA
PathCombineA
UrlCombineA
UrlCreateFromPathA
UrlIsNoHistoryA
UrlUnescapeA
PathCompactPathA

clusapi

ClusterEnum
CloseCluster
ClusterControl
CloseClusterNode
CloseClusterGroup

uxtheme

GetThemeBackgroundExtent
GetWindowTheme
CloseThemeData
GetThemePosition
GetCurrentThemeName
GetThemeSysBool
GetThemeFilename
GetThemeSysFont
GetThemeSysSize
GetThemeBackgroundRegion
DrawThemeText

comsvcs

CoCreateActivity
CoLoadServices
CoEnterServiceDomain
RecycleSurrogate
SafeRef

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.kdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcrs
Size: 11.8MB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

73d8a8cfb02b3dec1afcf0551350983a

Headers

DLL Characteristics

File Characteristics

Imports

nddeapi

certcli

crypt32

kernel32

shlwapi

clusapi

uxtheme

comsvcs

Sections

.text Size: 96KB - Virtual size: 96KB

.kdata Size: 8KB - Virtual size: 8KB

.zdata Size: 1KB - Virtual size: 1KB

.rcrs Size: 11.8MB - Virtual size: 1KB

.text
Size: 96KB - Virtual size: 96KB

.kdata
Size: 8KB - Virtual size: 8KB

.zdata
Size: 1KB - Virtual size: 1KB

.rcrs
Size: 11.8MB - Virtual size: 1KB