fa3409736cb759cf105600f18f447eba

Sharing

Copy URL Twitter E-mail

General

Target

fa3409736cb759cf105600f18f447eba
Size

16KB
MD5

fa3409736cb759cf105600f18f447eba
SHA1

0f91f5e084d5c36aa436ad5d035a2f3f3ff2473f
SHA256

42d62c51a36091937cdb8e7ffbf855e0644984b0d6281c28d2d5de3bf7762d06
SHA512

60af38ba598ea743b16a3f8d7d96dadf542bc6592acc7aa4542231a06fae863ff442102a00e5713d24481aeb45781c922a950703514e9cddd9328ad9ec98b2e6
SSDEEP

384:To2k2s6t37okUyLvtvxb4ZhIRhjLqhtimYphsg4DnYrkvWYhKl/oixLnbbLU:TfCsbiIRR2tiLHsg4DnYoO+K5zLPLU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/whop.scr

Files

fa3409736cb759cf105600f18f447eba
.zip
whop.scr
.exe windows:5 windows x86 arch:x86

abe419df550107c081fafd8ffe205844

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UpdateResourceA
CloseHandle
GetStringTypeA
GetLongPathNameA
lstrcpynA
GetProcessId
GetComputerNameA
SetEnvironmentVariableW
GetEnvironmentVariableA
GetCurrentProcess
GetProcAddress
WaitForSingleObject
GetBinaryTypeA
GetTimeFormatA
GetConsoleAliasW
HeapValidate
GetPrivateProfileStructW
GetGeoInfoA
LoadLibraryA
ReadConsoleA

msimg32

DllInitialize
GradientFill
AlphaBlend
TransparentBlt

wtsapi32

WTSOpenServerW
WTSVirtualChannelClose
WTSVirtualChannelPurgeInput
WTSLogoffSession
WTSSetUserConfigW
WTSUnRegisterSessionNotification
WTSEnumerateProcessesA
WTSSendMessageA
WTSFreeMemory
WTSRegisterSessionNotification
WTSQueryUserToken
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSQuerySessionInformationA

shlwapi

UrlCreateFromPathA
UrlCanonicalizeA
UrlIsNoHistoryW
UrlGetLocationA
UrlIsA
UrlUnescapeA
UrlIsOpaqueA
UrlCombineA
UrlHashA
UrlEscapeA
UrlCompareA
PathCompactPathA

nddeapi

NDdeShareAddA
NDdeShareEnumA
NDdeShareSetInfoA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 661B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

abe419df550107c081fafd8ffe205844

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msimg32

wtsapi32

shlwapi

nddeapi

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 661B

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 661B

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 2KB - Virtual size: 2KB