136896c2cdc3f689876e0d44485153ea

Sharing

Copy URL Twitter E-mail

General

Target

136896c2cdc3f689876e0d44485153ea
Size

67KB
MD5

136896c2cdc3f689876e0d44485153ea
SHA1

ac0637e6cd67e8252e2ab70ace756f8b2e08d66d
SHA256

e0a305b2b828c80d680ca4560e2a529156900bd111e1357faef797cdad2636b8
SHA512

1abd682c34108b55d674fbad0ec47800ccad353ffea8a2e5b6068969a0b0bc343ebd46229ce5da3405dcc0d2a42ca9d1f0496d67769934ec9534e3362ff2a4eb
SSDEEP

768:I53RKoUAg+c6uzJBXJDy0g1FX3vxBytpxXJ6xjmH6HN6UKEcmu1jKvC:6LcDzfXSh/x0BOqyN6rmu1kC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
136896c2cdc3f689876e0d44485153ea

Files

136896c2cdc3f689876e0d44485153ea
.exe windows:6 windows x86 arch:x86

e94175bcab63e584dc35ed8ab393b5be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
CreateDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
lstrlenW
CreateProcessW
VerSetConditionMask
VerifyVersionInfoW
LoadLibraryW
OutputDebugStringW
WriteFile
FlushFileBuffers
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetSystemTime
GetLastError
SetLastError
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
ReleaseMutex
WaitForSingleObject
CreateMutexW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetSystemDirectoryW
LoadLibraryExW
GetDriveTypeW
GetVolumePathNameW
GetFileType
GetSystemInfo
GetModuleHandleW
CompareStringW
GetProcessHeap
HeapFree
HeapAlloc
GetCommandLineW
FreeLibrary
OpenEventW
GetProcAddress
WideCharToMultiByte
InterlockedExchange
Sleep
InterlockedCompareExchange

msvcrt

__dllonexit
_unlock
_controlfp
?terminate@@YAXXZ
free
malloc
memmove
memcpy
memset
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_lock
_cexit
__wgetmainargs
_vsnwprintf
_onexit
_exit

ole32

CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeEx

advapi32

AllocateAndInitializeSid
FreeSid
GetTokenInformation
DuplicateTokenEx
CheckTokenMembership
IsValidSid
CopySid
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
GetUserNameW
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegCloseKey

oleaut32

VariantInit
VariantClear

shlwapi

StrRChrW
ord176
PathStripToRootW
PathIsRelativeW
StrChrW
PathIsRootW
PathIsUNCW

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e94175bcab63e584dc35ed8ab393b5be

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ole32

advapi32

oleaut32

shlwapi

Sections

.text Size: 35KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 35KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 3KB - Virtual size: 3KB