f4c4c3644647daf8b89ab41310959deb

Sharing

Copy URL

Twitter E-mail

General

Target

f4c4c3644647daf8b89ab41310959deb
Size

4.4MB
MD5

f4c4c3644647daf8b89ab41310959deb
SHA1

839b47a84b196b785f999b21f9c134d2f8533cc6
SHA256

70ab02dd40195d7f56c76f7bcdf24b61209247edceb1bc76af800ef74666ee4a
SHA512

1c2f8e38e89e5f0a04460a305a1a53e59b02eea531afc3d034473d980cf16597c77e5220b1eaa575d36f085c0c25dc97161a8d00febe019eff4e3590a79c3bc4
SSDEEP

49152:WbJv9QhqgmdKKKFBbri5lbQLyeKu8uFvboVm4hUHMNEHHHTDO0ADydTGOlSBKAn:w2lbchbW6VB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4c4c3644647daf8b89ab41310959deb

Files

f4c4c3644647daf8b89ab41310959deb
.exe windows:6 windows x86 arch:x86

1adc4102ea3e876472f8d185ffc0bf40

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
GlobalUnlock
GlobalLock
K32GetModuleFileNameExA
GetLastError
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
CloseHandle
SetEndOfFile
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
Sleep
IsDebuggerPresent
GetThreadTimes
DebugBreak
WideCharToMultiByte
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
MultiByteToWideChar
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetExitCodeThread
GetNativeSystemInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
InitializeSListHead
RaiseException
GetStartupInfoW
GetCurrentProcessId
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
SetProcessAffinityMask
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
LoadLibraryW
WaitForSingleObject
RtlUnwind
HeapValidate
GetSystemInfo
GetModuleHandleExW
ExitThread
ResumeThread
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapSize
HeapReAlloc
HeapQueryInformation
GetFileType
WriteConsoleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
SetFilePointerEx
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
GetTimeZoneInformation
FindClose
FindFirstFileExW
RtlCaptureStackBackTrace

user32

GetClipboardData
CloseClipboard
GetGUIThreadInfo
GetKeyboardLayout
GetAsyncKeyState
GetKeyState
OpenClipboard
GetWindowThreadProcessId

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom

Sections

.textbss
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 706KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1adc4102ea3e876472f8d185ffc0bf40

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.textbss Size: - Virtual size: 1.6MB

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 706KB - Virtual size: 706KB

.data Size: 80KB - Virtual size: 97KB

.idata Size: 5KB - Virtual size: 5KB

.msvcjmc Size: 1024B - Virtual size: 676B

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 156KB - Virtual size: 155KB

.textbss
Size: - Virtual size: 1.6MB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 706KB - Virtual size: 706KB

.data
Size: 80KB - Virtual size: 97KB

.idata
Size: 5KB - Virtual size: 5KB

.msvcjmc
Size: 1024B - Virtual size: 676B

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 156KB - Virtual size: 155KB