0e2a3534b9caa5e4d7044c0da2b000e8

Sharing

Copy URL

Twitter E-mail

General

Target

0e2a3534b9caa5e4d7044c0da2b000e8
Size

327KB
MD5

0e2a3534b9caa5e4d7044c0da2b000e8
SHA1

f7a0cedd155ea269097403e523b5ff2223ed011d
SHA256

818ea341771d4a04cfaffeb9565eb92becbe9fff07750b22a9c13132d3b1276f
SHA512

56189db0efae489b622254a604a384c2e1196e4d7727dba5d20b2b6be79f744b0264d6a000c8fa25ca1569d05bcf3396eafaf4b17c3c51dd82c09d3c3710874e
SSDEEP

6144:WfrPYAE94pFQTRIlYXxA7zbMhM2+zYYQHHW19WMZVbZfwJj:WT5pFuI1MM2+zYYQHQ9WMZVK9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e2a3534b9caa5e4d7044c0da2b000e8

Files

0e2a3534b9caa5e4d7044c0da2b000e8
.exe windows:4 windows x86 arch:x86

db8253f7bc0841114e8cb4b11bf2752a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
lstrlenW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetLastError
InitializeCriticalSection
DisableThreadLibraryCalls
SetWaitableTimer
WaitForSingleObject
VirtualAlloc
GetProcAddress
LoadLibraryW
FreeLibrary
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
GetCurrentThread
GetLastError
CloseHandle
InterlockedIncrement
GetCommandLineA
VirtualProtect
VirtualFree
GetModuleHandleA
GetStartupInfoA

user32

wsprintfW
LoadStringW

advapi32

DuplicateTokenEx
LsaQueryInformationPolicy
LsaOpenPolicy
CopySid
GetTokenInformation
OpenThreadToken
FreeSid
LsaNtStatusToWinError
RegisterEventSourceW
ReportEventW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetLengthSid
OpenProcessToken
AccessCheck
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
LsaRetrievePrivateData
CryptGetHashParam
CryptDeriveKey
RegConnectRegistryW
RegSetValueExW
LsaClose
AllocateAndInitializeSid
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
LsaFreeMemory

rpcrt4

RpcRevertToSelf
I_RpcMapWin32Status
RpcImpersonateClient
RpcRevertToSelfEx
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW

msvcr71

_controlfp
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
__setusermatherr
__getmainargs
_amsg_exit
_acmdln
_except_handler3
_wtoi
free
malloc
wcsncpy
_wcsupr
wcscpy
wcslen
_snwprintf
_CxxThrowException
_adjust_fdiv
_initterm
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit

Sections

.text
Size: 275KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db8253f7bc0841114e8cb4b11bf2752a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

rpcrt4

msvcr71

Sections

.text Size: 275KB - Virtual size: 275KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 263KB

.sxdata Size: 512B - Virtual size: 8B

.rsrc Size: 46KB - Virtual size: 46KB

.text
Size: 275KB - Virtual size: 275KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 263KB

.sxdata
Size: 512B - Virtual size: 8B

.rsrc
Size: 46KB - Virtual size: 46KB