11627a52190cebb5fd18f641a6789e29

Sharing

Copy URL

Twitter E-mail

General

Target

11627a52190cebb5fd18f641a6789e29
Size

103KB
MD5

11627a52190cebb5fd18f641a6789e29
SHA1

3753fbf0b7eb10f27a1b8f2f42b1031ef5947e31
SHA256

3529e1c7de5322e78cb5f800909893a1c3a48c5d0040dce4aaf616494d470968
SHA512

e622af6fb50aadf2013363335d9523d756d0e4ed231f242388d4a551fa5e9e170ca8a14a2eca607130ece0c7c311d8d7d809504b2947b42a00458aa388e819ad
SSDEEP

1536:CqJW3IBqpAXmqmuyBXSu6omC/w539lGzNP5x2d5shY73Y:dJW38/4EdVGNxxjhYLY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11627a52190cebb5fd18f641a6789e29

Files

11627a52190cebb5fd18f641a6789e29
.exe windows:4 windows x86 arch:x86

82b892c1560f7376c05585101c514482

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

DragQueryFileA
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHFileOperationA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHFileOperationA

comctl32

ImageList_Remove
ImageList_Destroy
ImageList_DragShowNolock
ImageList_Remove
ImageList_Create
ImageList_Read
ImageList_Add
ImageList_Destroy
ImageList_GetBkColor
ImageList_DrawEx
ImageList_GetBkColor
ImageList_Destroy
ImageList_Draw
ImageList_Create
ImageList_DrawEx
ImageList_Add

ole32

CoReleaseMarshalData
CreateBindCtx
StgCreateDocfileOnILockBytes
PropVariantClear
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoRevokeClassObject
OleRegGetUserType
CreateOleAdviseHolder
StgOpenStorage

comdlg32

GetSaveFileNameA
FindTextA
GetOpenFileNameA

kernel32

GetProcAddress
DeleteFileA
GetModuleHandleA
GetACP
GetOEMCP
GetLastError
ExitThread
VirtualAllocEx
GetProcAddress

oleaut32

SysFreeString
OleLoadPicture
SysStringLen
GetErrorInfo
VariantCopyInd
SafeArrayUnaccessData
VariantChangeType
SafeArrayPtrOfIndex
RegisterTypeLib
SafeArrayGetUBound
SafeArrayUnaccessData
OleLoadPicture
SafeArrayCreate
SysStringLen

user32

IsDialogMessageA
FrameRect
GetWindowDC
CharLowerA
GetCursor
IsWindowVisible
MoveWindow
CreateWindowExA
GetFocus
IsChild

gdi32

GetDIBits
RestoreDC
CreatePalette
BitBlt

advapi32

RegCreateKeyExA
RegOpenKeyA

version

VerFindFileA
GetFileVersionInfoSizeA

shlwapi

SHGetValueA

Sections

CODE
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 523B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82b892c1560f7376c05585101c514482

Headers

File Characteristics

Imports

shell32

comctl32

ole32

comdlg32

kernel32

oleaut32

user32

gdi32

advapi32

version

shlwapi

Sections

CODE Size: 30KB - Virtual size: 29KB

.rdata Size: 1024B - Virtual size: 523B

.tls Size: 69KB - Virtual size: 68KB

.data Size: 1KB - Virtual size: 1KB

CODE
Size: 30KB - Virtual size: 29KB

.rdata
Size: 1024B - Virtual size: 523B

.tls
Size: 69KB - Virtual size: 68KB

.data
Size: 1KB - Virtual size: 1KB