0420667dcab04069868e92a8f0fa4930

Sharing

Copy URL

Twitter E-mail

General

Target

0420667dcab04069868e92a8f0fa4930
Size

1.4MB
MD5

0420667dcab04069868e92a8f0fa4930
SHA1

b6c5ed778e941ab77e5b318e14c16679e437f6c5
SHA256

48fa7b9a0a571367000a2774715e5019f14728bff46c80f8e4eaa89a2add3141
SHA512

4722f3cca266c85e333f4b2d4015b237b245755cd3b6672ab6d07c33458506da0c97a2c569606a875e068980d6afaeca32eb750cb4ca6b2e736fa407e595ce01
SSDEEP

24576:oHmPZwqeMvE4JYO56msrwCoIjeS/phsB2/T4cRz71dypetmXQMVkBu4eER6W0T:oUFcGYkqpP/pSo/scY0/R6lT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0420667dcab04069868e92a8f0fa4930

Files

0420667dcab04069868e92a8f0fa4930
.exe windows:4 windows x86 arch:x86

e24250d6a40673aa549dd9ec14b94478

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

LPSAFEARRAY_UserUnmarshal
VarBstrCat
VarR4FromUI1
VarBoolFromI4
VarI8FromI2
VarUI2FromI4
SafeArrayGetVartype
VarUI1FromI8
BSTR_UserSize
OleCreatePictureIndirect
VarBstrFromI1
VarDateFromUI1
VarBoolFromI2
VarUI1FromUI2
VarBstrFromI4

kernel32

GetSystemWow64DirectoryW
RestoreLastError
AttachConsole
GetTimeZoneInformation
GetVolumeInformationA
CreateDirectoryW
CreateHardLinkA
CreateFileMappingA
FlushFileBuffers
GetTempPathA
FindFirstVolumeMountPointA
GetModuleHandleA
UnregisterWait
IsBadStringPtrW
LoadLibraryA
SearchPathW
VirtualAlloc
GetEnvironmentVariableA
SetConsoleFont
LocalAlloc
SetPriorityClass
SetTapePosition
GetNamedPipeInfo
EnumCalendarInfoW

msacm32

acmStreamPrepareHeader
acmGetVersion
acmStreamReset
acmDriverRemove
acmFormatTagDetailsW
acmFilterTagEnumA
acmFormatChooseW
acmFilterChooseW
acmDriverAddA
acmDriverAddW
acmFormatDetailsA
acmFormatChooseA
acmDriverMessage
acmFormatTagDetailsA
acmMetrics
XRegThunkEntry

printui

DocumentPropertiesWrap
bFolderEnumPrinters
PrintNotifyTray_Exit
vQueueCreate
PnPInterface
vDocumentDefaults
PrinterPropPageProvider
PrintUIEntryW
PrintNotifyTray_Init
bFolderGetPrinter
bFolderRefresh
RegisterPrintNotify
bPrinterSetup
DllMain
ConnectToPrinterDlg

ntdll

RtlImageRvaToVa
NtFlushWriteBuffer
ZwQueryTimer
NtContinue
ZwQuerySystemTime
RtlPushFrame
RtlSetAttributesSecurityDescriptor
ceil
DbgUiConnectToDbg
qsort
_strnicmp
CsrCaptureTimeout
LdrVerifyImageMatchesChecksum
RtlDecompressFragment
RtlInitializeResource

iphlpapi

GetInterfaceInfo
GetIpAddrTable
IcmpParseReplies
InternalSetIpForwardEntry
InternalCreateIpForwardEntry
GetIpNetTable
RestoreMediaSense
IcmpCreateFile
_PfSetLogBuffer@28
CreateProxyArpEntry
do_echo_req
GetTcpStatistics
GetIfTable
IcmpSendEcho
DisableMediaSense
GetBestRoute
GetUdpTable
InternalSetIpStats
SetAdapterIpAddress
AddIPAddress
do_echo_rep
Icmp6SendEcho2

Sections

.text
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 311KB - Virtual size: 1023KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e24250d6a40673aa549dd9ec14b94478

Headers

File Characteristics

Imports

oleaut32

kernel32

msacm32

printui

ntdll

iphlpapi

Sections

.text Size: 484KB - Virtual size: 483KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 311KB - Virtual size: 1023KB

.rsrc Size: 6KB - Virtual size: 6KB

.text
Size: 484KB - Virtual size: 483KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 311KB - Virtual size: 1023KB

.rsrc
Size: 6KB - Virtual size: 6KB