1072adf97cdd936f0f561cad699d512f

Sharing

Copy URL Twitter E-mail

General

Target

1072adf97cdd936f0f561cad699d512f
Size

50KB
MD5

1072adf97cdd936f0f561cad699d512f
SHA1

f26cdd98db461b0d0f49e6b4b7ef14b670b35583
SHA256

754017b4f68d1fe58cfc5360397b2f0a8f9ea0f4b308dad673532903edebebbe
SHA512

500b0215e5baa06c0c723413b33b7cc77a8c016d913a8b577dcd1c7597b0cc0992a84c4ac640aa83ebf0d925d1b2e19415559b67f9822e1d18f8141a42c1c79d
SSDEEP

768:+SuAn3TFlPoX+Y6Vy0Ri7l9A8u9Ll82jQ4eViAFmKjT+8W49r0VBjDM:+an3TAXWVji77A857FP4QW00zjA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1072adf97cdd936f0f561cad699d512f

Files

1072adf97cdd936f0f561cad699d512f
.exe windows:5 windows x64 arch:x64

5f1965f5ee758f31109975afd0cdc07e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlTimeToTimeFields
RtlComputeCrc32
sprintf
RtlStringFromGUID
RtlInitUnicodeString
ZwWriteFile
ZwSetValueKey
wcstoul
ZwQueryVolumeInformationFile
RtlTimeToSecondsSince1970
RtlNtStatusToDosError
ZwCreateFile
LdrAccessResource
LdrFindResource_U
RtlFreeUnicodeString
ZwSetContextThread
ZwWriteVirtualMemory
ZwProtectVirtualMemory
ZwSetInformationFile
ZwWaitForSingleObject
ZwGetContextThread
RtlExitUserThread
RtlCreateUserThread
ZwDuplicateObject
ZwOpenFile
RtlDosPathNameToNtPathName_U
ZwClose
RtlAdjustPrivilege
ZwImpersonateThread
ZwOpenThread
ZwOpenProcess
ZwQuerySystemInformation
ZwOpenKey
ZwQueryValueKey
RtlIpv4StringToAddressExW
_wtoi64
wcschr
ZwQueueApcThread
ZwAllocateVirtualMemory
RtlEqualUnicodeString
ZwOpenEvent
ZwResumeThread
ZwQueryInformationFile
ZwCreateKey
LdrFindEntryForAddress
__chkstk
memcpy

kernel32

GetVersion
GetLastError
BindIoCompletionCallback
GetSystemDefaultLangID
HeapAlloc
GetSystemTimeAsFileTime
Sleep
GetCommandLineW
LoadLibraryExW
ExitProcess
VirtualFree
VirtualAlloc
GetModuleHandleW
HeapFree
GetProcessHeap

advapi32

MD5Final
MD5Update
MD5Init

ws2_32

WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSAStartup

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f1965f5ee758f31109975afd0cdc07e

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

advapi32

ws2_32

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 724B

.pdata Size: 1024B - Virtual size: 576B

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 724B

.pdata
Size: 1024B - Virtual size: 576B

.rsrc
Size: 2KB - Virtual size: 2KB