007f1c18e002c1d5c8fbba68e76ab5cf

Sharing

Copy URL Twitter E-mail

General

Target

007f1c18e002c1d5c8fbba68e76ab5cf
Size

4.4MB
MD5

007f1c18e002c1d5c8fbba68e76ab5cf
SHA1

00d54bbcfed3248bd360c605eaf2e75bd85e4b99
SHA256

284b3dde6049c0d9be0c3cd55b0e5c286796d937e4964347e3d3fb8fda495cfc
SHA512

10addb33452b5c436561097c9e3564785fc92b1857ccd0da0e5a7e903e370ab210403015ca694fee8873b3bc2cc1b4ceac9242409aa2b2f886f5e2c23434e157
SSDEEP

98304:ndWaWB9X314sW/xcJQ8VdXk+OR7BYrLSFYMYmwC3H9XGbF4k9efO:aBt14xcJtrUnB+KYMYOVGbZcfO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
007f1c18e002c1d5c8fbba68e76ab5cf

Files

007f1c18e002c1d5c8fbba68e76ab5cf
.exe windows:5 windows x64 arch:x64

1f80f1cd81b94f85521db216e293a080

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

MessageBoxA

kernel32

UnhandledExceptionFilter
GetVersionExA
GetProcAddress
LoadLibraryA
GetLastError
ExpandEnvironmentStringsA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetShortPathNameW
GetTempPathW
Sleep
LoadLibraryExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetCommandLineW
GetStartupInfoW
GetStdHandle
GetModuleFileNameW
HeapSize
RtlUnwindEx
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
CreateDirectoryA
GetCurrentProcessId
DeleteFileA
RemoveDirectoryA
FindNextFileA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DecodePointer
EncodePointer
SetConsoleCtrlHandler
GetModuleHandleW
ExitProcess
HeapReAlloc
GetDriveTypeW
GetFullPathNameA
GetFileAttributesA
GetCommandLineA
TerminateProcess
GetCurrentProcess
CompareStringW
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CloseHandle
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
GetCurrentDirectoryW
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
WriteFile
SetHandleCount
DeleteCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
ReadFile
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LoadLibraryW
CreateFileW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
GetStringTypeW

ws2_32

ntohl

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bypass.pyc
_pyi_bootstrap.pyc
pyi_carchive.pyc

Sharing

General

Malware Config

Signatures

Files

1f80f1cd81b94f85521db216e293a080

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

ws2_32

Sections

.text Size: 106KB - Virtual size: 106KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 7KB - Virtual size: 47KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 60KB - Virtual size: 59KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 106KB - Virtual size: 106KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 7KB - Virtual size: 47KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 60KB - Virtual size: 59KB

.reloc
Size: 1KB - Virtual size: 1KB