dae499b7ffbc5e8e941e83f943f63d73

Sharing

Copy URL

Twitter E-mail

General

Target

dae499b7ffbc5e8e941e83f943f63d73
Size

2.9MB
MD5

dae499b7ffbc5e8e941e83f943f63d73
SHA1

9b57a6eeeb4b7091bb7ed186e9dea9aff9b417b8
SHA256

e32af93bd259d6695fb8093bf5ab3911f031c84b3dd3010f83778d89a654dce1
SHA512

6123a8d828a2b37fbf55e06b8b9e790f8fdb1b2b52b5e3efa98f5dbd5d6e64f82e8f534411b99fcbbf756ba832f73ff37b58d7c3987311d96c5808aa0cd885e6
SSDEEP

49152:6v9aXHHWebu3Joverc/s6e8vbT/EMgGMqkWhIPpsst9j8cu1pxsVnmdH7xVTMOpC:6v9aXnWea3Jov2+s983MbGrk2Iua8c4D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dae499b7ffbc5e8e941e83f943f63d73

Files

dae499b7ffbc5e8e941e83f943f63d73
.exe windows:5 windows x86 arch:x86

5d8379b33aec9e37ba20f18ed7e1f3e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupIterateCabinetW

psapi

GetModuleFileNameExW
EnumProcesses

kernel32

GetProcessHeap
EnumResourceNamesW
FindFirstFileW
FindResourceW
FreeLibrary
LoadResource
CreateProcessW
EndUpdateResourceW
CreateDirectoryW
WaitForSingleObject
WriteFile
OpenProcess
LoadLibraryW
Sleep
CopyFileW
SizeofResource
TerminateProcess
GetModuleFileNameW
CreateFileW
GetTempPathW
GetUserDefaultLCID
BeginUpdateResourceW
FindClose
LockResource
SetCurrentDirectoryW
UpdateResourceW
CloseHandle
EnumResourceLanguagesW
DeleteFileW
ExitProcess
GetCommandLineW
AllocConsole
CreateThread
WideCharToMultiByte
GetFileInformationByHandle
GetFileSize
ReadFile
SetEndOfFile
SetStdHandle
WriteConsoleW
GetLocaleInfoA
EnumSystemLocalesA
GetLastError
LeaveCriticalSection
LCMapStringW
IsProcessorFeaturePresent
GetStringTypeW
SetFilePointer
HeapSize
CreateFileA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapAlloc
RtlUnwind
MultiByteToWideChar
IsValidCodePage
GetOEMCP
EnterCriticalSection
IsValidLocale
GetProcAddress
GetModuleHandleW
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapFree
FatalAppExitA
SetConsoleCtrlHandler
InterlockedExchange
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP

user32

wsprintfW
GetMessageW

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW

shell32

SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW

winhttp

WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d8379b33aec9e37ba20f18ed7e1f3e3

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

psapi

kernel32

user32

advapi32

shell32

winhttp

Sections

.text Size: 123KB - Virtual size: 123KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 123KB - Virtual size: 123KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 4KB - Virtual size: 4KB