13ebb4ee1c9d03da8baca59b5904b592

Sharing

Copy URL Twitter E-mail

General

Target

13ebb4ee1c9d03da8baca59b5904b592
Size

191KB
MD5

13ebb4ee1c9d03da8baca59b5904b592
SHA1

08dcbf25ca3a5afcb25d01706e633d2e26fdd56a
SHA256

8f7a8855b2e38b24373639e1bc576ee89bc547f731f8e49822fbea10fd02ca9b
SHA512

7867bc9d3d1b97275651f66a4c52b797168ad4f95249485565b7b25f71840bcda3a8ec3904b6b6cd72883395e4994afac5e57f39d9165bf0e8f3603134917916
SSDEEP

3072:eJ2id6kVmcy6NtYS4HkJya3QR5uzFB8hD5xvgfKfEk7KFAi9U/BLc25GjY7fbB+L:eJ76p6OEJyaARoYhlx+Ksxv2YaTUL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13ebb4ee1c9d03da8baca59b5904b592

Files

13ebb4ee1c9d03da8baca59b5904b592
.exe windows:4 windows x86 arch:x86

cf3029eddf865916b9e68f2b680c58dc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
GetVersionExA
FreeLibrary
WriteFile
SizeofResource
LoadResource
FindResourceA
GetLastError
SetFileAttributesA
lstrcatA
GetSystemDirectoryA
GetTempPathA
HeapFree
HeapAlloc
GetProcessHeap
LockResource
SetLastError
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
Sleep
DeleteFileA
SwitchToThread
WaitForSingleObject
CreateEventA
OpenEventA
GetCurrentThreadId
MoveFileExA
MoveFileA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetTickCount
SetFilePointer
CreateFileA
InitializeCriticalSection
CloseHandle
VirtualAlloc
VirtualFree
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeResource
GetStringTypeW
GetStringTypeA
RtlUnwind
GetCommandLineA
GetStartupInfoA
HeapDestroy
HeapCreate
HeapReAlloc
GetStdHandle
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetFileType
VirtualQuery
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW

user32

GetInputState
PostThreadMessageA
GetMessageA
SendMessageTimeoutA
wsprintfA

advapi32

GetUserNameA
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA

netapi32

NetUserGetLocalGroups
NetApiBufferFree

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf3029eddf865916b9e68f2b680c58dc

Headers

File Characteristics

Imports

kernel32

user32

advapi32

netapi32

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 133KB - Virtual size: 133KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 133KB - Virtual size: 133KB