1a6a5219bf99ba21d71b5c44167d36f2

Sharing

Copy URL Twitter E-mail

General

Target

1a6a5219bf99ba21d71b5c44167d36f2
Size

126KB
MD5

1a6a5219bf99ba21d71b5c44167d36f2
SHA1

24f2b8b012faef5d415149549b9f160558a5b3d3
SHA256

e6bf98258f655244a1cf491f315f995cb8692d2879b2bffc42112cbace56a925
SHA512

706c854cd5f0c50aa166882971fbe96e30efe9ff3ba0ef595e05aafeb2b6f8cf6c03e9c4954fba598f9c68059d32c298620d2d2ea25f7b4e75435a3ba9a1b879
SSDEEP

1536:09g5cmAAdm86txxkypOwaq1mvi85ExHW1H0xtLrhkM50:Tbkxxk7q1S6tfWM50

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a6a5219bf99ba21d71b5c44167d36f2

Files

1a6a5219bf99ba21d71b5c44167d36f2
.exe windows:5 windows x86 arch:x86

08fcf999eb932b3d5966f0edd2412a4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA

ole32

CoInitialize

kernel32

CloseHandle
TerminateThread
WaitForSingleObject
CreateThread
ExpandEnvironmentStringsA
lstrlenA
lstrcatA
lstrcpyA
SetLastError
GetLastError
CreateRemoteThread
GetProcAddress
GetExitCodeProcess
GetFileAttributesExA
GetCurrentProcess
GetModuleHandleA
CreateMutexA
MoveFileA
RemoveDirectoryA
DeleteFileA
CreateDirectoryA
GetTempPathA
GetCommandLineA
GetModuleFileNameA
Sleep
GetLocalTime
GetTickCount
WriteFile
GetProcessHeap
ReadFile
DuplicateHandle
RaiseException
SetEndOfFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetFilePointer
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoA
HeapFree
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
HeapSize
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc

advapi32

RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA

user32

wsprintfA

shlwapi

PathGetArgsA
PathFileExistsA
PathIsDirectoryA
PathRemoveBlanksA
PathFindFileNameA

ws2_32

recv
send
gethostbyname
select
connect
closesocket
__WSAFDIsSet
htons
socket
WSAStartup
ioctlsocket

netapi32

Netbios

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

08fcf999eb932b3d5966f0edd2412a4f

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ole32

kernel32

advapi32

user32

shlwapi

ws2_32

netapi32

Sections

.text Size: 82KB - Virtual size: 82KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 4KB - Virtual size: 31KB

.text
Size: 82KB - Virtual size: 82KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 4KB - Virtual size: 31KB