c7e087a0630c94b08bc5210b7761b11b85517fa5f80088c9c5547afe485b29f2

Sharing

Copy URL

Twitter E-mail

General

Target

c7e087a0630c94b08bc5210b7761b11b85517fa5f80088c9c5547afe485b29f2
Size

430KB
MD5

2a1860f0dfba23a39f7ca397623d97b4
SHA1

547d458e1e93f145a79aa4c9e462eb651469d2a2
SHA256

c7e087a0630c94b08bc5210b7761b11b85517fa5f80088c9c5547afe485b29f2
SHA512

13e464623a70665efcc7d87a87e8668f72ca6c9e9647c4480f7915394d8690f098b842a828056c34717ef2b76bf3221ed080bbfdf788c6620c6ba3f9e5d311c6
SSDEEP

12288:oyIcgCzmJcPnoOobJ5+Bec37vtNdRUwVLj:dgCzmJcPnotfW7jtpUwVLj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7e087a0630c94b08bc5210b7761b11b85517fa5f80088c9c5547afe485b29f2

Files

c7e087a0630c94b08bc5210b7761b11b85517fa5f80088c9c5547afe485b29f2
.exe windows:5 windows x86 arch:x86

9d83714f57bdb84f6220ca3ac3a03496

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleHandleW
DecodePointer
WaitForSingleObject
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
WaitForMultipleObjects
TerminateProcess
CreateDirectoryW
VerSetConditionMask
VerifyVersionInfoW
WideCharToMultiByte
GetProcAddress
MultiByteToWideChar
LocalFree
SetErrorMode
SetSystemTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
SetLastError
CreateProcessW
GetModuleFileNameW
FlushFileBuffers
WriteConsoleW
SetStdHandle
LoadLibraryExW
GetCurrentDirectoryW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
HeapSize
GetStdHandle
GetModuleHandleExW
ExitProcess
CloseHandle
GetLastError
CreateMutexW
GetCurrentThreadId
GetOEMCP
GetACP
IsValidCodePage
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
GetDriveTypeW
IsProcessorFeaturePresent
InterlockedCompareExchange
GetLongPathNameW
InterlockedIncrement
Sleep
GetFileAttributesW
CreateFileW
ExpandEnvironmentStringsW
GetSystemDirectoryW
GlobalFree
OutputDebugStringW
WriteFile
SetEndOfFile
ReadFile
GetStringTypeW
EncodePointer
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineW
GetFullPathNameW
GetSystemTimeAsFileTime
GetFileAttributesExW
IsDebuggerPresent

user32

AllowSetForegroundWindow
GetForegroundWindow
MessageBoxW

advapi32

AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
FreeSid
CheckTokenMembership

shell32

CommandLineToArgvW
ShellExecuteW
SHCreateDirectoryExW
ShellExecuteExW
SHFileOperationW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

shlwapi

PathRemoveArgsW
PathUnquoteSpacesW
PathGetArgsW
SHRegGetPathW
PathRemoveFileSpecW
PathAppendW
PathCombineW
PathCanonicalizeW
PathAddBackslashW
PathFindFileNameW

ws2_32

WSAStartup
WSACleanup
gethostbyname
htons
socket
setsockopt
sendto
recvfrom
closesocket

winhttp

WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect

Sections

.text
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.QMGuid
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9d83714f57bdb84f6220ca3ac3a03496

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

version

shlwapi

ws2_32

winhttp

Sections

.text Size: 188KB - Virtual size: 187KB

.rdata Size: 140KB - Virtual size: 139KB

.data Size: 7KB - Virtual size: 16KB

.QMGuid Size: 512B - Virtual size: 20B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 81KB - Virtual size: 84KB

.text
Size: 188KB - Virtual size: 187KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 7KB - Virtual size: 16KB

.QMGuid
Size: 512B - Virtual size: 20B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 81KB - Virtual size: 84KB