JB4562D0OLEG3KMP610U_LRl8V6Ve[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

JB4562D0OLEG3KMP610U_LRl8V6Ve.exe
Size

552KB
MD5

17ed797b7b39b993f2d42b78c173b324
SHA1

912dcf87800f169b0388a15114205e15cf87ec13
SHA256

552df400b2cd596b6476467402394ecf99678b31cfac0d418edff0e43c3cd0f0
SHA512

1406d4cdeaa00eae6f49c055139e39b5a0424cf5c51073746199aea57af63e01fd0f5327ecf50c1e324448d8a90494c4309990638a1bbaf75623336a9194b760
SSDEEP

12288:9mPtU4wVlFEuL600BVIWCWodo8l25CrccPz4IDQuFJnEDlPOn:2tUVEum0Mxodo8sTgEDJOn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JB4562D0OLEG3KMP610U_LRl8V6Ve.exe

Files

JB4562D0OLEG3KMP610U_LRl8V6Ve.exe
.exe windows:6 windows x64 arch:x64

504f45cf2d70e6f2cf060779dbe17e7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptReleaseContext
RegOpenKeyExA

kernel32

GetProcAddress
GetModuleHandleA

user32

MessageBoxA
DefWindowProcA

shell32

ShellExecuteExA
SHChangeNotifyRegister

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

ntdll

NtQuerySystemInformation

normaliz

IdnToAscii

ws2_32

ntohl

wldap32

ord41

crypt32

CertGetCertificateChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy

api-ms-win-crt-stdio-l1-1-0

_close

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-string-l1-1-0

toupper

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-runtime-l1-1-0

__p___argc

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.rdata
Size: - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

504f45cf2d70e6f2cf060779dbe17e7a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

shell32

ole32

oleaut32

msvcp140

ntdll

normaliz

ws2_32

wldap32

crypt32

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.rdata Size: - Virtual size: 384KB

.reloc Size: - Virtual size: 129KB

.rsrc Size: - Virtual size: 20KB

.rsrc Size: 1024B - Virtual size: 836B

.reloc Size: 101KB - Virtual size: 100KB

.rdata
Size: - Virtual size: 384KB

.reloc
Size: - Virtual size: 129KB

.rsrc
Size: - Virtual size: 20KB

.rsrc
Size: 1024B - Virtual size: 836B

.reloc
Size: 101KB - Virtual size: 100KB