aa4d336672d6b8ed69f6cca797b51bff

Sharing

Copy URL Twitter E-mail

General

Target

aa4d336672d6b8ed69f6cca797b51bff
Size

260KB
MD5

aa4d336672d6b8ed69f6cca797b51bff
SHA1

e6a1e1a8c031797c2fa80d4f5cf7279b8946b1f5
SHA256

ce9d5ad9a430031abfe6a2e3ed97d5c2f6e276672aefd4f2cc2a284751cbfc03
SHA512

fe51dc2a88f9e7960eb1ce3b5819acc55a01af9652396b896ee0f718d0606881c6a864a3b7f39ba1332b80f0a2376153271420be2bba3d8f62a79d029fbc9bb4
SSDEEP

6144:oILnzlNrlJmpmJzwFeBY/97odBE+sGyd8O:rrlgwMFeu/97oTE+sGY8O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa4d336672d6b8ed69f6cca797b51bff

Files

aa4d336672d6b8ed69f6cca797b51bff
.exe windows:5 windows x86 arch:x86

8caf80d3add684709cb7dff4cfa8369b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
SetConsoleActiveScreenBuffer
InterlockedCompareExchange
LockFile
SetFileTime
GetProcessTimes
GetTapePosition
lstrlenW
CreateMailslotW
GetTempPathW
GetStartupInfoA
GetProcAddress
IsValidCodePage
LoadLibraryA
SetConsoleCursorInfo
GetThreadPriority
CancelTimerQueueTimer
FindFirstChangeNotificationW
VirtualProtect
GetVersion
CloseHandle
CreateFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetVolumeNameForVolumeMountPointA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
RaiseException
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
HeapAlloc
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetACP
GetOEMCP
GetUserDefaultLCID
GetModuleHandleA

user32

IsRectEmpty
VkKeyScanA
SetScrollInfo
GetTabbedTextExtentA
GetSysColor
GetWindowRgn
RealGetWindowClassW
IsCharAlphaA
SetKeyboardState
DefDlgProcW
UnhookWinEvent
GetDoubleClickTime
GetInputState

advapi32

ReportEventA

ole32

OleInitialize
ReleaseStgMedium
CoQueryProxyBlanket
GetConvertStg
OleGetClipboard
CoGetMarshalSizeMax

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8caf80d3add684709cb7dff4cfa8369b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 7KB - Virtual size: 5.0MB

.rsrc Size: 133KB - Virtual size: 133KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 7KB - Virtual size: 5.0MB

.rsrc
Size: 133KB - Virtual size: 133KB

.reloc
Size: 20KB - Virtual size: 19KB