0ecfad8fca6d1fd4f45ee53386ac6e7d

Sharing

Copy URL

Twitter E-mail

General

Target

0ecfad8fca6d1fd4f45ee53386ac6e7d
Size

74KB
MD5

0ecfad8fca6d1fd4f45ee53386ac6e7d
SHA1

75e05604a9b48e28e7849f2e076c7e4dbf7f4df4
SHA256

79f1be8551abf92b3ff73366a7acffd9580fe5f820ec7d65a3d4152c876b2d56
SHA512

af3910cf38b67863ec8acabb4d0f380c777d1f6997db39ebd8916638709b8349c913420d9e6f057591ba202f567d707c5d65ca4354cd248aa5356b009e24fcb0
SSDEEP

1536:4akddMwRWsR1YD5UNntBULdUCW9m5YOVjOL9yKzh4o:9GMwRWsR18WNtEqD9m5Id4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ecfad8fca6d1fd4f45ee53386ac6e7d

Files

0ecfad8fca6d1fd4f45ee53386ac6e7d
.exe windows:5 windows x86 arch:x86

f4051b8ba4d8bdbbbe99f0dde3368463

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoRevertToSelf
ReleaseStgMedium
OleQueryCreateFromData
CreateBindCtx
CoInitialize
StgOpenStorage
StgCreateDocfile
CoRevokeClassObject
StgIsStorageFile
CreateStreamOnHGlobal
CreateOleAdviseHolder
CoGetObjectContext
CoInitializeSecurity
CoSetProxyBlanket
CoReleaseMarshalData

advapi32

IsValidAcl
InitializeAcl
RegOpenKeyA
GetAclInformation
RegEnumKeyW
GetUserNameW
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyW
CloseServiceHandle
GetSecurityDescriptorLength
LookupAccountNameW
LookupAccountSidW
RegQueryValueExA
RegEnumKeyExA
GetSecurityDescriptorControl
EqualSid
RegQueryInfoKeyA
OpenThreadToken
RegSetValueExA
LsaQueryInformationPolicy

shell32

ShellExecuteExW
SHBrowseForFolderW
SHGetFolderPathW
SHFileOperationW
SHBrowseForFolderA

user32

GetCursorPos
OffsetRect
EnableMenuItem
EqualRect
GetSysColor
DestroyWindow
EndPaint
LoadStringA
GetSystemMetrics
GetSystemMenu
GetCapture
GetDC
FindWindowA
RegisterWindowMessageW
PeekMessageW
GetClientRect
CharLowerW
CallWindowProcW
RegisterClipboardFormatW
GetClassNameA
GetWindowDC
RegisterClassW
GetPropA
SetDlgItemTextW
IsChild
GetAncestor
DestroyIcon
GetActiveWindow

kernel32

FindFirstFileA
IsBadWritePtr
InterlockedExchange
VirtualFree
WriteConsoleW
GetSystemDirectoryA
TerminateProcess
FindFirstFileW
GetExitCodeProcess
lstrcmpiA
GetFileSize
GetWindowsDirectoryW
GetProcessHeap
CreateFileMappingA
GetConsoleOutputCP
VirtualAlloc
CreateProcessW
SizeofResource
MultiByteToWideChar
lstrcatA
ExitProcess
GlobalAlloc
VirtualProtect
UnhandledExceptionFilter
OpenProcess
GetStringTypeA
SystemTimeToFileTime

rpcrt4

RpcStringFreeW
NdrServerCall2
RpcImpersonateClient
CStdStubBuffer_IsIIDSupported
RpcStringFreeA
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_CountRefs
IUnknown_AddRef_Proxy
NdrStubCall2
UuidCreate
RpcBindingSetAuthInfoExW
RpcStringBindingParseW
RpcBindingFromStringBindingW
UuidToStringA
UuidToStringW
RpcEpResolveBinding

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 15KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 42KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f4051b8ba4d8bdbbbe99f0dde3368463

Headers

File Characteristics

Imports

ole32

advapi32

shell32

user32

kernel32

rpcrt4

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 7KB - Virtual size: 7KB

.tls Size: 15KB - Virtual size: 26KB

.idata Size: 42KB - Virtual size: 91KB

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 7KB - Virtual size: 7KB

.tls
Size: 15KB - Virtual size: 26KB

.idata
Size: 42KB - Virtual size: 91KB