0ebefc9744bef5d707e1dfd9d30bfd95

Sharing

Copy URL

Twitter E-mail

General

Target

0ebefc9744bef5d707e1dfd9d30bfd95
Size

216KB
MD5

0ebefc9744bef5d707e1dfd9d30bfd95
SHA1

ee869c40160ecd1e92a0e9b7f95b15f4c45e3e01
SHA256

cfe90e9b4dd78483cf11b9f68e978907f1bf5602e73e0fd3368340d409d4310e
SHA512

9737128af00fa418410c30ff4753290b1e021344710ee802fba2ce5b189b06f6808d680e4e6bbad0ac5ccebabee33db42f1eeb5d0f4f0510708fdb004854747f
SSDEEP

6144:5WmY0snba+a6uxpc89pKf/Yt69v4ytGmc:5WmzsUxi4KfSuv4qGmc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ebefc9744bef5d707e1dfd9d30bfd95

Files

0ebefc9744bef5d707e1dfd9d30bfd95
.exe windows:5 windows x86 arch:x86

e84f927a17f7a4065f50a637d9afefa5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessW
GetCommandLineW
GetSystemDirectoryW
GetExitCodeProcess
CopyFileW
WriteFile
GetOEMCP
GetPrivateProfileStructA
ExitProcess
GetModuleFileNameW
GetConsoleCP
GetCurrentProcess
VirtualAlloc
CreateEventA
FormatMessageA
InterlockedIncrement
GetShortPathNameW
GetPrivateProfileSectionNamesA
GetFullPathNameW
SetFileAttributesA

version

GetFileVersionInfoA
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

advapi32

SetSecurityDescriptorDacl
RegEnumKeyExW
LookupPrivilegeValueA
RegDeleteKeyW
EnumServicesStatusExA
RegEnumValueW
LookupAccountSidW
LockServiceDatabase
ChangeServiceConfigA
QueryServiceConfigA
GetSecurityDescriptorControl
RegCreateKeyExA
RegQueryValueExW
RegCreateKeyExW
RegQueryInfoKeyA
CreateServiceA
ChangeServiceConfig2A

gdi32

GetDIBits
GetTextMetricsA
GetTextAlign
SetTextCharacterExtra
GetDCOrgEx
GetPaletteEntries
PolyDraw
GetWinMetaFileBits

msvcrt

_beginthread
_open_osfhandle
swscanf
srand
_itow
printf
__CxxFrameHandler
_vsnwprintf
wcstok
_wfopen
wprintf
_fullpath
_wcsdup
wcschr
isxdigit
exit
_snprintf
_adjust_fdiv
_vsnprintf
memset
_lseeki64
wcsrchr
fopen
__p__fmode
_CxxThrowException
qsort
div
_wtoi
_purecall
wcstoul
strncmp
_controlfp

Sections

.text
Size: 129KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 35KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 34KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e84f927a17f7a4065f50a637d9afefa5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

version

advapi32

gdi32

msvcrt

Sections

.text Size: 129KB - Virtual size: 130KB

.data Size: 2KB - Virtual size: 2KB

.rdata Size: 35KB - Virtual size: 384KB

.idata Size: 34KB - Virtual size: 88KB

.rsrc Size: 15KB - Virtual size: 15KB

.text
Size: 129KB - Virtual size: 130KB

.data
Size: 2KB - Virtual size: 2KB

.rdata
Size: 35KB - Virtual size: 384KB

.idata
Size: 34KB - Virtual size: 88KB

.rsrc
Size: 15KB - Virtual size: 15KB