006568a8512453d797db9e07ec2880ff

Sharing

Copy URL

Twitter E-mail

General

Target

006568a8512453d797db9e07ec2880ff
Size

254KB
MD5

006568a8512453d797db9e07ec2880ff
SHA1

1b93d19f7f38d6de8f7fcae3de1369a529897f82
SHA256

79e772546c1e0229359193dbd33176ea92df4209c84353e89f8e1d1b10820546
SHA512

a4068c651f10c17fd914cf96741856469dcaaf57190d66487fb247d70ab0fee542efa3735ea2d7b49b3138cffd84813ea506f9bb2095c87dee17997d7565b7b7
SSDEEP

6144:eAaE/V1w+H3PX6rPswaCNAJwY7PEjy61eUbxkB6r4K:eAaE/zw+HP8aCN4BjBMb4K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
006568a8512453d797db9e07ec2880ff

Files

006568a8512453d797db9e07ec2880ff
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

4975576ccf867bea05fcc1154a22f9b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SafeArrayPutElement

gdi32

GetWinMetaFileBits
EnumFontsA
CreateBrushIndirect
RealizePalette
SetPixel
CreateCompatibleDC
IntersectClipRect
FrameRgn

winspool.drv

GetPrinterDataA
DeleteMonitorA
ClosePrinter

kernel32

WinExec
GetConsoleMode
GetStringTypeExA
CreateDirectoryA
SetEvent
GetTimeFormatA
ReleaseMutex
SetFilePointer
LocalReAlloc
GetLogicalDrives
GlobalReAlloc
GetLastError
GetUserDefaultUILanguage
GetCurrentDirectoryW
GetSystemTimeAsFileTime
OutputDebugStringA
QueryDosDeviceA
GetTickCount
GetStdHandle
GetTimeFormatW
GetVolumeInformationW
FindNextFileW
IsBadWritePtr
GetSystemDirectoryW
SetErrorMode
lstrcatA
LoadLibraryW
VirtualAlloc
TerminateProcess
SuspendThread
GetWindowsDirectoryA
GlobalFlags
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetUserDefaultLangID
TlsAlloc
GetFileAttributesW
EnumSystemLocalesA
UnhandledExceptionFilter
GetShortPathNameW
GetLongPathNameW
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetPrivateProfileStringA
GetPrivateProfileIntW
FindCloseChangeNotification
GetCurrentProcess
CreateSemaphoreW
WritePrivateProfileStringW
CreateMutexW
GetStartupInfoW
GetPrivateProfileSectionA
_lread
MoveFileA
GlobalGetAtomNameA
GetProcessHeap
GetFileTime
GetConsoleOutputCP
GetShortPathNameA
GetDriveTypeW
GetStartupInfoA
CopyFileA
DeleteFileW
GetTempFileNameA
GetSystemInfo
GetModuleHandleW
SetProcessWorkingSetSize
lstrcmpA
GetSystemDefaultLangID
GlobalUnlock
GlobalLock
CreateThread
AddAtomA
GetFullPathNameW
GetACP
lstrlenA
HeapSetInformation
GetFullPathNameA
FindClose
GetDateFormatW
GetModuleHandleA
SetThreadLocale
GetDiskFreeSpaceA

user32

CheckDlgButton

comdlg32

CommDlgExtendedError
ChooseColorA
GetSaveFileNameA

shlwapi

PathGetDriveNumberW

advapi32

RegEnumKeyW
OpenProcessToken
GetSidLengthRequired
SetSecurityDescriptorOwner
SetSecurityDescriptorControl
AccessCheck
CheckTokenMembership
RegCloseKey
GetSidIdentifierAuthority
RegDeleteValueW
BuildExplicitAccessWithNameW
RegDeleteValueA
CopySid
CryptGetHashParam
GetSecurityDescriptorLength

version

GetFileVersionInfoSizeW

comctl32

ImageList_SetIconSize
ImageList_DragMove
ord17

msvcrt

localtime
exit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_strlwr
_vsnprintf
_splitpath
_stricmp
_wsplitpath
_beginthreadex
tolower
longjmp
atoi
_wtoi
wcsstr
_CxxThrowException
towupper
_fpreset
_mbsrchr
swscanf
wcscpy
_wcsupr
_XcptFilter
_wtol
iswspace
fread
_expand
isdigit
_ltow
_wcslwr
strstr
wcsncpy
swprintf
_msize
atof
_ismbblead
wcstol
_exit
_acmdln

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

oyygscu
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

kmiwg
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

qikuq
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4975576ccf867bea05fcc1154a22f9b3

Headers

File Characteristics

Imports

oleaut32

gdi32

winspool.drv

kernel32

user32

comdlg32

shlwapi

advapi32

version

comctl32

msvcrt

Sections

.text Size: 190KB - Virtual size: 189KB

oyygscu Size: 45KB - Virtual size: 44KB

kmiwg Size: 3KB - Virtual size: 2KB

qikuq Size: 15KB - Virtual size: 15KB

.text
Size: 190KB - Virtual size: 189KB

oyygscu
Size: 45KB - Virtual size: 44KB

kmiwg
Size: 3KB - Virtual size: 2KB

qikuq
Size: 15KB - Virtual size: 15KB