d9bd21e8a1bb85ea00bdb56fee9d2d51

General

Target

d9bd21e8a1bb85ea00bdb56fee9d2d51
Size

558KB
MD5

d9bd21e8a1bb85ea00bdb56fee9d2d51
SHA1

d926427756b9af2f508192030eadc7820dc9a425
SHA256

b6c6588eb2bc0ae88a010035a75387c8655f80e29d371301fbf2cbbb86c370c5
SHA512

4b703c9ba173a8463e607d3765ce7d39ba3749db0f16c8c7372d486ae85b2b29c072e288e969ac914d0ee32f4823e8d72bcf631633b34abf5f6e974854e54faa
SSDEEP

12288:buhB/VygOATOipnNECNRRtDyLS8X1s7deRVqZ:buhBdygOAKipGC/RteLS8yp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9bd21e8a1bb85ea00bdb56fee9d2d51

Files

d9bd21e8a1bb85ea00bdb56fee9d2d51
.exe windows:4 windows x86 arch:x86

83e800c7435eede238b3f257c5bc5ab4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mapi32

BMAPIAddress
BMAPIAddress
BMAPIDetails
BMAPIFindNext
BMAPIGetAddress
BMAPIGetReadMail
BMAPIReadMail
BMAPIResolveName
BMAPISaveMail
BMAPISendMail
BuildDisplayTable@40
CbOfEncoded@4
CchOfEncoding@4
ChangeIdleRoutine@28
CloseIMsgSession@4
CreateIProp@24
CreateTable@36
DeinitMapiUtil@0
DeregisterIdleRoutine@4
DllCanUnloadNow
DllGetClassObject
EnableIdleRoutine@8
EncodeID@12
FBadColumnSet@4
FBadEntryList@4
FBadProp@4
FBadPropTag@4

imm32

ImmGetContext
ImmLockClientImc
ImmIsIME
ImmInstallIMEW
ImmLockIMC
ImmLockIMCC
ImmLockImeDpi
ImmNotifyIME
ImmRegisterClient
ImmRegisterWordA
ImmRegisterWordW
ImmEnumInputContext
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmCreateIMCC
ImmActivateLayout
ImmDisableIME
ImmGenerateMessage
ImmGetAppCompatFlags
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetCandidateWindow
ImmGetCompositionFontA
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetCompositionWindow
ImmGetContext
ImmGetConversionListA

kernel32

GetLastError
CreateFileA
GetWindowsDirectoryA
GetACP
OutputDebugStringW
AttachConsole
SetThreadLocale
HeapSetInformation
CreateRemoteThread
QueryDosDeviceA
LZRead

gdi32

CloseFigure
CloseFigure

Sections

.text
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 318KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 504KB - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83e800c7435eede238b3f257c5bc5ab4

Headers

File Characteristics

Imports

mapi32

imm32

kernel32

gdi32

Sections

.text Size: 31KB - Virtual size: 32KB

.data Size: 13KB - Virtual size: 318KB

.rsrc Size: 504KB - Virtual size: 504KB

.text
Size: 31KB - Virtual size: 32KB

.data
Size: 13KB - Virtual size: 318KB

.rsrc
Size: 504KB - Virtual size: 504KB