886fec0fe3401464e580de55d859cdce

Sharing

Copy URL Twitter E-mail

General

Target

886fec0fe3401464e580de55d859cdce
Size

747KB
MD5

886fec0fe3401464e580de55d859cdce
SHA1

551b7ced0240102fea6dd41f5347396b211e6c31
SHA256

5935116eeb6a7f728edfdcdeb6765cea20a0ae78b54ec39f3709c470636b5cfb
SHA512

8ff365566c8d1df1669be916b034940db5ac4c5d60784b48b14965dc61531df987cbb41f9989ec8f0c57f749d5aa810d3bb4952a60392c86f32264d1010a3692
SSDEEP

6144:t+p/vwgQ0wABtzx0um8vP94RTMxvvvvvYvkLviNraRJcml:tmXwFUzxHdvP9gTJNGRJ1l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
886fec0fe3401464e580de55d859cdce

Files

886fec0fe3401464e580de55d859cdce
.exe windows:5 windows x86 arch:x86

755265145de341023432ed759ab55132

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileW
RemoveDirectoryW
DecodePointer
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
Sleep
FindFirstFileW
TerminateProcess
OpenProcess
FindResourceExW
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
LocalFree
FindResourceW
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
FlushFileBuffers
FindClose
DeleteFileW
GetCurrentProcess
GetCommandLineW
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LoadLibraryExW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
IsDebuggerPresent
OutputDebugStringW
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCurrentThreadId
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW

shlwapi

PathRemoveFileSpecW

psapi

GetModuleFileNameExW

Sections

.text
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 550KB - Virtual size: 550KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

755265145de341023432ed759ab55132

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

psapi

Sections

.text Size: 142KB - Virtual size: 142KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 550KB - Virtual size: 550KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 142KB - Virtual size: 142KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 550KB - Virtual size: 550KB

.reloc
Size: 8KB - Virtual size: 7KB