7665499f2a1dfd55439c266831f1584d

Sharing

Copy URL Twitter E-mail

General

Target

7665499f2a1dfd55439c266831f1584d
Size

1.0MB
MD5

7665499f2a1dfd55439c266831f1584d
SHA1

da39a7bcbd898900b42a2a053bf040b9c89ca1b9
SHA256

720dda988f52c63aa949df9a7b4c5d3e7bd1aa52eda88f965f1d62385f18eaf1
SHA512

e524fbc30276c75f77b38d69ce8b4a5f37df76953f99e40a459ac368cca5f3ae978162f3da66aeb45d737e2a047b116cc541a4ff1e480d5fc04153277b69e35c
SSDEEP

12288:IZQcFp9J2/XSjp8cqNUfZ3QKgfS0Z0s9k/B+ojmBNgOR1y/K:fcFp9J2XSjp8cP/D0Zlkp+KNo1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7665499f2a1dfd55439c266831f1584d

Files

7665499f2a1dfd55439c266831f1584d
.exe windows:6 windows x64 arch:x64

e58000a8cae0fb40c01445aa692340d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExitProcess
SetEndOfFile
SetPriorityClass
GetSystemTime
GetDiskFreeSpaceExW
OpenProcess
GetTempPathW
LocalFree
DeleteFileW
FindFirstFileW
FindClose
GetVolumeNameForVolumeMountPointW
FindNextFileW
SetThreadPriority
GetCurrentThread
GetFileAttributesW
WaitForMultipleObjects
SetEvent
CreateEventA
ReOpenFile
SetLastError
GlobalSize
GlobalLock
GlobalUnlock
SetFilePointer
GetDriveTypeW
GetProcAddress
LoadLibraryA
GetCurrentProcessId
DeleteFileA
ResetEvent
HeapAlloc
GetFileSize
HeapFree
lstrcmpiA
GlobalMemoryStatusEx
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetConsoleWindow
SetFilePointerEx
DeviceIoControl
CreateFileA
GetDriveTypeA
GetSystemWindowsDirectoryW
GetLogicalDrives
GetLastError
MoveFileW
SetFileAttributesW
CreateDirectoryW
ReadFile
GetFileSizeEx
Wow64RevertWow64FsRedirection
CreateProcessW
Wow64DisableWow64FsRedirection
CloseHandle
FlushFileBuffers
WriteFile
CreateFileW
OutputDebugStringW
WaitForSingleObject
CreateThread
Sleep
GetModuleFileNameW
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
HeapQueryInformation
HeapSize
HeapReAlloc
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCommandLineW
GetCommandLineA
GetStdHandle
FreeLibraryAndExitThread
GetProcessHeap
GetCurrentProcess
ExitThread
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
RtlUnwind
TlsGetValue
TlsAlloc
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess

user32

ShowWindow
wsprintfA
wsprintfW
ReleaseDC
GetSystemMetrics
GetDC

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
DeleteDC
BitBlt
SelectObject

advapi32

RegCloseKey
RegisterServiceCtrlHandlerW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetEntriesInAclW
SetNamedSecurityInfoW
GetTokenInformation
ConvertSidToStringSidA
OpenProcessToken
SetServiceStatus
RegSetValueExA
RegCreateKeyExA
StartServiceCtrlDispatcherW

ole32

GetHGlobalFromStream
CLSIDFromString
CreateStreamOnHGlobal

psapi

EnumProcesses
GetModuleFileNameExA
GetModuleFileNameExW

ws2_32

ioctlsocket
WSAStartup
closesocket
recv
send
setsockopt
connect
htons
inet_addr
socket
select

iphlpapi

GetAdaptersInfo

netapi32

NetShareEnum
NetApiBufferFree

gdiplus

GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipSaveImageToStream
GdipBitmapGetPixel
GdipGetImageWidth
GdipGetImageHeight
GdipFree
GdipAlloc
GdipDisposeImage
GdipCloneImage

rstrtmgr

RmGetList
RmRegisterResources
RmStartSession
RmEndSession

Sections

.text
Size: 617KB - Virtual size: 616KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 239KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e58000a8cae0fb40c01445aa692340d0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

psapi

ws2_32

iphlpapi

netapi32

gdiplus

rstrtmgr

Sections

.text Size: 617KB - Virtual size: 616KB

.rdata Size: 177KB - Virtual size: 177KB

.data Size: 239KB - Virtual size: 246KB

.pdata Size: 26KB - Virtual size: 26KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 617KB - Virtual size: 616KB

.rdata
Size: 177KB - Virtual size: 177KB

.data
Size: 239KB - Virtual size: 246KB

.pdata
Size: 26KB - Virtual size: 26KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB