131c6581856f106157c7ac3a4560a917

Sharing

Copy URL Twitter E-mail

General

Target

131c6581856f106157c7ac3a4560a917
Size

28KB
MD5

131c6581856f106157c7ac3a4560a917
SHA1

a116a92c7913e18de5916d216d5174a30f801003
SHA256

db804351c753c0247d753ce86a08145a6af3f07db71edc8ee13efaa59f172a1a
SHA512

cef55220f17d3bbfb1d834fa75d65a3e41a2db7625f6a7b8dc48302cc1a9bfac1517dcb021218cfdf097a962c15c65b16f34aba9d30ed7b1e6a511baffa4136b
SSDEEP

384:qfskZMmqvIGM62z1HlYXkdI0QunSModOoIg1/Uk5:qfWwGM3TUunSJlIas

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
131c6581856f106157c7ac3a4560a917

Files

131c6581856f106157c7ac3a4560a917
.exe windows:4 windows x86 arch:x86

2f0196bdfb91d136c1de6fc31c8ba4df

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CreateDirectoryA
lstrlenA
CopyFileA
GetComputerNameA
GetModuleFileNameA
CreateThread
GetTempPathA
lstrcatA
DeleteFileA
CreateFileA
WriteFile
CloseHandle
WinExec
Sleep
FreeLibrary
GetModuleHandleA
GetProcAddress
ExitProcess
LoadLibraryA
GetStartupInfoA

advapi32

SetServiceStatus
RegOpenKeyExA
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
CreateServiceA
StartServiceCtrlDispatcherA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueA
RegisterServiceCtrlHandlerA

msvcirt

?get@istream@@QAEHXZ
?put@ostream@@QAEAAV1@E@Z
??_Dofstream@@QAEXXZ
??_Difstream@@QAEXXZ
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
??1ofstream@@UAE@XZ
?close@ofstream@@QAEXXZ
?close@ifstream@@QAEXXZ
?flush@ostream@@QAEAAV1@XZ
?tellp@ostream@@QAEJXZ
?tellg@istream@@QAEJXZ
??0ofstream@@QAE@PBDHH@Z
??0ifstream@@QAE@PBDHH@Z
?openprot@filebuf@@2HB
?read@istream@@QAEAAV1@PADH@Z

msvcrt

__CxxFrameHandler
_EH_prolog
strcmp
sprintf
free
strcat
strcpy
strstr
_sleep
atoi
strchr
calloc
fclose
fprintf
fopen
strlen
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
memset
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_exit
exit
_itoa
_strnicmp

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f0196bdfb91d136c1de6fc31c8ba4df

Headers

File Characteristics

Imports

kernel32

advapi32

msvcirt

msvcrt

msvcp60

Sections

.text Size: 12KB - Virtual size: 10KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 10KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 1KB