5ab3c21a5f1bf49cce470183403673c1

Sharing

Copy URL Twitter E-mail

General

Target

5ab3c21a5f1bf49cce470183403673c1
Size

2.9MB
MD5

5ab3c21a5f1bf49cce470183403673c1
SHA1

a8587b5d5d6a37decf410ed583b591d41b2ed80e
SHA256

f6c6d16c36b8f6942626abda7f8362db805c2fed9fccd069296825d7aeb9f4b7
SHA512

38c690ffc91144abd3b161d4777c53058192645508ab08fa3fa3e6e35fbe088817613bd5728f0bffe53de3e7b4a5ef3df5f86a31d6c1986b08cf1ad5c8cd9b67
SSDEEP

49152:rv9aXHB1rLKLl3ADfm5ZCmUs1pxsVnmTux5lWNKAsaqQvr7CclzskOuTrPSyxem9:rv9aXh1reR3A7mrCmU6VSx+D5vr7Cclq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ab3c21a5f1bf49cce470183403673c1

Files

5ab3c21a5f1bf49cce470183403673c1
.exe windows:5 windows x86 arch:x86

5d8379b33aec9e37ba20f18ed7e1f3e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupIterateCabinetW

psapi

GetModuleFileNameExW
EnumProcesses

kernel32

GetProcessHeap
EnumResourceNamesW
FindFirstFileW
FindResourceW
FreeLibrary
LoadResource
CreateProcessW
EndUpdateResourceW
CreateDirectoryW
WaitForSingleObject
WriteFile
OpenProcess
LoadLibraryW
Sleep
CopyFileW
SizeofResource
TerminateProcess
GetModuleFileNameW
CreateFileW
GetTempPathW
GetUserDefaultLCID
BeginUpdateResourceW
FindClose
LockResource
SetCurrentDirectoryW
UpdateResourceW
CloseHandle
EnumResourceLanguagesW
DeleteFileW
ExitProcess
GetCommandLineW
AllocConsole
CreateThread
WideCharToMultiByte
GetFileInformationByHandle
GetFileSize
ReadFile
SetEndOfFile
SetStdHandle
WriteConsoleW
GetLocaleInfoA
EnumSystemLocalesA
GetLastError
LeaveCriticalSection
LCMapStringW
IsProcessorFeaturePresent
GetStringTypeW
SetFilePointer
HeapSize
CreateFileA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapAlloc
RtlUnwind
MultiByteToWideChar
IsValidCodePage
GetOEMCP
EnterCriticalSection
IsValidLocale
GetProcAddress
GetModuleHandleW
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapFree
FatalAppExitA
SetConsoleCtrlHandler
InterlockedExchange
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP

user32

wsprintfW
GetMessageW

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW

shell32

SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW

winhttp

WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d8379b33aec9e37ba20f18ed7e1f3e3

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

psapi

kernel32

user32

advapi32

shell32

winhttp

Sections

.text Size: 123KB - Virtual size: 123KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 2.8MB - Virtual size: 2.8MB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 123KB - Virtual size: 123KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 4KB - Virtual size: 4KB