44c85e5f66451580f8f12668a5e688b2

Sharing

Copy URL Twitter E-mail

General

Target

44c85e5f66451580f8f12668a5e688b2
Size

648KB
MD5

44c85e5f66451580f8f12668a5e688b2
SHA1

a5b40d44494e817a68b2a2edd1a8c87076baa49e
SHA256

903ef9f4aa595e0ebf8ea0233681fd460cc87426141c251fb7f2cb9fc6fe7995
SHA512

7831b899e124784980be3ff9846899df7199c9b03946ae6423c27674ae80f317ce5c84847ac6df773db63fb961b7df47fa7ab1c6fd249a2fa4ae7213e71c8a65
SSDEEP

12288:fKWg15ZkMOO+vD8aCwTySIi+L4u1QyV9lVfVFEi6c5J8CvXZ:CWgFRuvDP5TV+L4uGy1L75J8CvX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44c85e5f66451580f8f12668a5e688b2

Files

44c85e5f66451580f8f12668a5e688b2
.exe windows:4 windows x86 arch:x86

e4ed19a349bc782e59ed83e3bac9bd0d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
lstrcpyA
InitializeCriticalSection
TerminateProcess
lstrlenA
CloseHandle
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
GetModuleHandleA
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
FindClose
LoadLibraryA
DeleteFileA
FindFirstFileA
GetModuleFileNameA
CopyFileA
WriteFile
SetFilePointer
CreateProcessA
SetEnvironmentVariableA
CompareStringW
CompareStringA
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
lstrcatA
GetProcAddress
LeaveCriticalSection
OpenFileMappingA
FindNextFileA
CreateFileMappingA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetLastError
ResumeThread
CreateThread
TlsSetValue
TlsGetValue
ExitThread
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
RaiseException
GetCurrentThreadId
TlsAlloc
SetLastError
HeapAlloc
UnhandledExceptionFilter
HeapReAlloc
HeapSize
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType

user32

MessageBoxA
SetWindowTextA
SendMessageA
EndDialog
CheckDlgButton
IsDlgButtonChecked
GetDlgItemTextA
GetWindowThreadProcessId
FindWindowA
GetDlgItem
DialogBoxParamA

gdi32

CreateFontA

shell32

ShellExecuteExA
ShellExecuteA

ws2_32

send
select
closesocket
connect
htons
inet_addr
socket
inet_ntoa
gethostbyname
WSAStartup
recv
__WSAFDIsSet

shlwapi

PathFindFileNameA
PathRemoveFileSpecA
PathFindExtensionA

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hao0
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hao1
Size: 544KB - Virtual size: 542KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4ed19a349bc782e59ed83e3bac9bd0d

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ws2_32

shlwapi

Sections

.text Size: 72KB - Virtual size: 68KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 12KB - Virtual size: 22KB

.hao0 Size: 4KB - Virtual size: 1KB

.hao1 Size: 544KB - Virtual size: 542KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 72KB - Virtual size: 68KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 12KB - Virtual size: 22KB

.hao0
Size: 4KB - Virtual size: 1KB

.hao1
Size: 544KB - Virtual size: 542KB

.rsrc
Size: 4KB - Virtual size: 1KB