be96ea47ac12a730e47693ec5f64fa02fb8e8a8571cefd48416380d08a0bb1a9

Sharing

Copy URL Twitter E-mail

General

Target

be96ea47ac12a730e47693ec5f64fa02fb8e8a8571cefd48416380d08a0bb1a9
Size

255KB
MD5

8a4626f190eb3425d17c56557476aa5c
SHA1

c81b8d908c14969b6a7e0194984a7eac5720c765
SHA256

be96ea47ac12a730e47693ec5f64fa02fb8e8a8571cefd48416380d08a0bb1a9
SHA512

58e7cf6e3f4770fa4939865389d752f029cecfb9c433b80cb9e0aafbfee28edc862e4f43fb64bd238520ab6703ca9c86b2d876639b1196da61dc19038413de97
SSDEEP

3072:LtJsOJawIGc7C5J8uzF4GQ+334d29p7HVfAOt1fbC6DyFA9+IXbGGjgaiFqN2CEn:JIsviGQc31RtzDp9dSe3NUA4NWPvi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be96ea47ac12a730e47693ec5f64fa02fb8e8a8571cefd48416380d08a0bb1a9

Files

be96ea47ac12a730e47693ec5f64fa02fb8e8a8571cefd48416380d08a0bb1a9
.exe windows:5 windows x86 arch:x86

dd96e0cec1b8a0478429697ce8e07973

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
EnterCriticalSection
GetSystemTime
RaiseException
GetTimeFormatW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateDirectoryW
GetDateFormatW
LocalFree
DeleteFileW
CreateEventW
LocalAlloc
CopyFileW
Sleep
TerminateThread
GetTickCount
SetEvent
WaitForSingleObject
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
Process32NextW
ProcessIdToSessionId
Process32FirstW
GetLastError
GetModuleFileNameW
TerminateProcess
OpenProcess
lstrcmpiW
DeleteCriticalSection
GetComputerNameExW
ReadConsoleW
ReadFile
SetEndOfFile
GetCurrentDirectoryW
GetDriveTypeW
OutputDebugStringW
WriteConsoleW
SetStdHandle
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetFileType
InterlockedCompareExchange
GetLongPathNameW
InterlockedIncrement
GetFileAttributesW
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
CreateThread
GetCurrentThreadId
ExitThread
GetProcAddress
LoadLibraryExW
HeapFree
GetCommandLineW
GetFullPathNameW
GetSystemTimeAsFileTime
RtlUnwind
HeapAlloc
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LCMapStringW
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
ExitProcess
GetModuleHandleExW
HeapSize
GetProcessHeap
GetStdHandle

advapi32

QueryServiceConfigW
ControlService
GetUserNameA
RevertToSelf
QueryServiceStatusEx
SetServiceStatus
ChangeServiceConfigW
ImpersonateLoggedOnUser
StartServiceW
ChangeServiceConfig2W
LookupAccountNameA
RegisterServiceCtrlHandlerExW
GetSidSubAuthorityCount
OpenServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
DeleteService
GetSidSubAuthority
CloseServiceHandle
GetSidIdentifierAuthority
CreateServiceW
DuplicateTokenEx
CreateProcessAsUserW
GetTokenInformation
OpenProcessToken

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

shlwapi

PathIsRelativeW
PathAddBackslashW
PathCanonicalizeW
PathFileExistsW
PathQuoteSpacesW
PathUnquoteSpacesW
SHRegGetPathW
PathAppendW
PathRemoveFileSpecW

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dd96e0cec1b8a0478429697ce8e07973

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

wtsapi32

userenv

shlwapi

Sections

.text Size: 84KB - Virtual size: 83KB

.rdata Size: 33KB - Virtual size: 33KB

.data Size: 6KB - Virtual size: 15KB

.rsrc Size: 42KB - Virtual size: 41KB

.reloc Size: 78KB - Virtual size: 80KB

.text
Size: 84KB - Virtual size: 83KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 6KB - Virtual size: 15KB

.rsrc
Size: 42KB - Virtual size: 41KB

.reloc
Size: 78KB - Virtual size: 80KB