0d444f5d38877934ca1c9abfa86c5282

Sharing

Copy URL

Twitter E-mail

General

Target

0d444f5d38877934ca1c9abfa86c5282
Size

72KB
MD5

0d444f5d38877934ca1c9abfa86c5282
SHA1

652c2efd0248dc93141b6fdd06ab7a10b3126659
SHA256

8ac03a5528365638301b8242d62a20779a00f1cdbef1a6d5c6c8d17c44716f45
SHA512

7266be87f8e751e042824b66db15cc2d93c5eb30e3934facd4861e60cb03cdbcdd5bc17fc47f5660224ffd868e3c713e3ed40a43b5f3b1878b627f8cbcac0cf6
SSDEEP

1536:PzzQcvJ2bgvveilffcbI00+LruoHIQP3qAsLQ73fEvYMro3fovzQ3PfADM60X/Gi:7jJdeil30

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d444f5d38877934ca1c9abfa86c5282

Files

0d444f5d38877934ca1c9abfa86c5282
.exe windows:4 windows x86 arch:x86

9e39aab95e8a1dac06702159eb997c70

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

kernel32

Sleep
CreateThread
CloseHandle
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
WriteProcessMemory
VirtualAllocEx
OpenProcess
lstrlenW
lstrlenA
GetCurrentProcess
ExitProcess
GetModuleHandleA
CreateMutexA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapSize
ReadFile
SetEndOfFile
SetFilePointer
GetCPInfo
GetOEMCP
GetACP
GetModuleFileNameA
VirtualProtect
GetLastError
TerminateProcess
LoadLibraryA
CreateFileA
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapFree
GetSystemInfo
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
InterlockedExchange
VirtualQuery
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers

user32

CreateDialogParamA
ShowWindow
UpdateWindow
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
SetCursor
SetDlgItemTextA
wsprintfW
FindWindowA
GetWindowThreadProcessId

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteA

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e39aab95e8a1dac06702159eb997c70

Headers

File Characteristics

Imports

winmm

kernel32

user32

advapi32

shell32

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 32KB - Virtual size: 29KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 32KB - Virtual size: 29KB