1815701b89ae598cc29ade79b9a3242f

Sharing

Copy URL Twitter E-mail

General

Target

1815701b89ae598cc29ade79b9a3242f
Size

21.1MB
MD5

1815701b89ae598cc29ade79b9a3242f
SHA1

82847101c2367b8393d9608103faa60cbec01d12
SHA256

3e66ad4d3af759a1d742320bbdeabba46d9e0601d411aaf21950a208a5094b87
SHA512

fbe91059e935194a50d096483dbdcfe6ce0bd97f5fbb13bfda2cd589901f3f641437e1f60089aada5b65c7b032f947eda59b09c90a169315dc6212a209af0fa0
SSDEEP

393216:6/QNTPSH0PtmhHLrT125pPgPmdL5liscEQV7zUmHvF9VPNwBcEI/9NhgIUNVD:6/QMH0PAhrrT12fPgmfiscEQ9fvtzNEn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1815701b89ae598cc29ade79b9a3242f

Files

1815701b89ae598cc29ade79b9a3242f
.exe windows:4 windows x86 arch:x86

e24250d6a40673aa549dd9ec14b94478

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

LPSAFEARRAY_UserUnmarshal
VarBstrCat
VarR4FromUI1
VarBoolFromI4
VarI8FromI2
VarUI2FromI4
SafeArrayGetVartype
VarUI1FromI8
BSTR_UserSize
OleCreatePictureIndirect
VarBstrFromI1
VarDateFromUI1
VarBoolFromI2
VarUI1FromUI2
VarBstrFromI4

kernel32

GetSystemWow64DirectoryW
RestoreLastError
AttachConsole
GetTimeZoneInformation
GetVolumeInformationA
CreateDirectoryW
CreateHardLinkA
CreateFileMappingA
FlushFileBuffers
GetTempPathA
FindFirstVolumeMountPointA
GetModuleHandleA
UnregisterWait
IsBadStringPtrW
LoadLibraryA
SearchPathW
VirtualAlloc
GetEnvironmentVariableA
SetConsoleFont
LocalAlloc
SetPriorityClass
SetTapePosition
GetNamedPipeInfo
EnumCalendarInfoW

msacm32

acmStreamPrepareHeader
acmGetVersion
acmStreamReset
acmDriverRemove
acmFormatTagDetailsW
acmFilterTagEnumA
acmFormatChooseW
acmFilterChooseW
acmDriverAddA
acmDriverAddW
acmFormatDetailsA
acmFormatChooseA
acmDriverMessage
acmFormatTagDetailsA
acmMetrics
XRegThunkEntry

printui

DocumentPropertiesWrap
bFolderEnumPrinters
PrintNotifyTray_Exit
vQueueCreate
PnPInterface
vDocumentDefaults
PrinterPropPageProvider
PrintUIEntryW
PrintNotifyTray_Init
bFolderGetPrinter
bFolderRefresh
RegisterPrintNotify
bPrinterSetup
DllMain
ConnectToPrinterDlg

ntdll

RtlImageRvaToVa
NtFlushWriteBuffer
ZwQueryTimer
NtContinue
ZwQuerySystemTime
RtlPushFrame
RtlSetAttributesSecurityDescriptor
ceil
DbgUiConnectToDbg
qsort
_strnicmp
CsrCaptureTimeout
LdrVerifyImageMatchesChecksum
RtlDecompressFragment
RtlInitializeResource

iphlpapi

GetInterfaceInfo
GetIpAddrTable
IcmpParseReplies
InternalSetIpForwardEntry
InternalCreateIpForwardEntry
GetIpNetTable
RestoreMediaSense
IcmpCreateFile
_PfSetLogBuffer@28
CreateProxyArpEntry
do_echo_req
GetTcpStatistics
GetIfTable
IcmpSendEcho
DisableMediaSense
GetBestRoute
GetUdpTable
InternalSetIpStats
SetAdapterIpAddress
AddIPAddress
do_echo_rep
Icmp6SendEcho2

Sections

.text
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 311KB - Virtual size: 1023KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e24250d6a40673aa549dd9ec14b94478

Headers

File Characteristics

Imports

oleaut32

kernel32

msacm32

printui

ntdll

iphlpapi

Sections

.text Size: 484KB - Virtual size: 483KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 311KB - Virtual size: 1023KB

.rsrc Size: 6KB - Virtual size: 6KB

.text
Size: 484KB - Virtual size: 483KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 311KB - Virtual size: 1023KB

.rsrc
Size: 6KB - Virtual size: 6KB