094a49d9327a9cbefa069087f6e0f25e

General

Target

094a49d9327a9cbefa069087f6e0f25e
Size

158KB
MD5

094a49d9327a9cbefa069087f6e0f25e
SHA1

427cc6d5e04b057a1bf30e94bfc68ae13df5c4fc
SHA256

8479c47eac171dc4e0880a5fc6e739873ba4445f46e8c115eeabc3aab3dcb4bd
SHA512

a7ce3a750444db0b92f50d6a19abfea6cd9d24ee2c48bfb068190530fb7ef9d93f2a5ed38886cf0ec556d9e7fe905094ebead85ea7d0c0af8880799d7685a819
SSDEEP

3072:m3a09ixDOQMurYFXtdZOH227Fz9pUXOSxUytXTWZfg5XOuUde:mJSDOgCXtCDUXOydFKZ45nUd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
094a49d9327a9cbefa069087f6e0f25e

Files

094a49d9327a9cbefa069087f6e0f25e
.exe windows:5 windows x86 arch:x86

63b1633aad465f9fe9275cad2b855f7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord65

user32

CloseWindow
GetWindowTextLengthA
AnyPopup
GetDesktopWindow
GetForegroundWindow

kernel32

GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
GetCommandLineA
CreateMutexA
CreateEventA
CompareStringA
GetCurrentProcessId
GetEnvironmentStringsW
GetCommandLineW
GetProcAddress
GetModuleHandleA
GetTickCount
GetVersionExA
CompareStringW
VirtualAlloc
TlsFree
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetEnvironmentVariableA
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
HeapReAlloc
IsBadWritePtr
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sleep
IsValidLocale
IsValidCodePage

gdi32

AbortDoc
GetTextMetricsA

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63b1633aad465f9fe9275cad2b855f7f

Headers

DLL Characteristics

File Characteristics

Imports

msi

user32

kernel32

gdi32

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 111KB - Virtual size: 200KB

.rsrc Size: 1024B - Virtual size: 608B

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 111KB - Virtual size: 200KB

.rsrc
Size: 1024B - Virtual size: 608B