1a976898f730ff158eeb925ebced2b81

Sharing

Copy URL Twitter E-mail

General

Target

1a976898f730ff158eeb925ebced2b81
Size

180KB
MD5

1a976898f730ff158eeb925ebced2b81
SHA1

63cc8aba5bed46651bc0beec7b646c6ce2af072a
SHA256

e13947985419f53f5bd65d30e088d8e8c4eeb3d634eb317813351de5edbc54b1
SHA512

7ab9201738efb45cc2fa53d49bea7089ba0bbc87762af0f5172d940f7622a6ee62499e918d862d08c883375a76507a5a669db2d9c6106d9857e4223abc2d31ca
SSDEEP

3072:zoUl9dmmpTWsL1IO8bp9E6gZQgIW2PRDMO3RINZEaJvddCa/l:MKtpTWgIPE6gZQgIH3REEq1/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a976898f730ff158eeb925ebced2b81

Files

1a976898f730ff158eeb925ebced2b81
.exe windows:4 windows x86 arch:x86

ba5df895611866ec61bd9601595dee56

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
FileTimeToSystemTime
GlobalGetAtomNameA
GetStartupInfoA
GetACP
GetLastError
GetVersionExA
TerminateProcess
GetSystemDirectoryA
WriteFile
lstrcpyA
GetModuleFileNameA
FindFirstFileA
FindNextFileA
FindClose
Sleep
SetFileAttributesA
SetFilePointer
DeleteFileA
MoveFileA
CreateFileA
GetFileSize
CloseHandle
ReadFile
lstrlenA
OpenProcess
ReadProcessMemory

user32

SendMessageA
GetDlgItem
EndDialog
MessageBoxA
GetActiveWindow
SendDlgItemMessageA
wvsprintfA
SetDlgItemTextA
DialogBoxParamA
ShowWindow
DefWindowProcA
CreateWindowExA
ReleaseDC
GetDC
ScrollWindow
InvalidateRect
SetWindowRgn
MoveWindow
GetWindowRect
PostMessageA
RegisterClassA
LoadCursorA
SetTimer
GetDesktopWindow
CharNextA

gdi32

CreateDIBitmap
StretchDIBits
GetPixel
DeleteDC
SelectObject
CreateCompatibleDC
TextOutA
SetTextAlign
SetTextColor
GetObjectA
SetBkMode
CreateFontIndirectA
CombineRgn
CreateRectRgn
DeleteObject
GetStockObject
BitBlt

wsock32

bind
closesocket
WSACleanup
gethostbyname
ioctlsocket
connect
htonl
setsockopt
send
WSAGetLastError
htons
inet_addr
recv
ntohl
socket
WSAStartup

comctl32

ord17

msvcrt

_lseek
fclose
free
remove
ftell
_exit
getenv
sscanf
calloc
_snprintf
strcspn
_strnicmp
strncmp
_stricmp
strspn
__CxxFrameHandler
fgets
atoi
_write
_close
_unlink
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_read
fread
_initterm
__getmainargs
_acmdln
srand
rand
exit
_XcptFilter
vsprintf
time
realloc
bsearch
fopen
_open
_stat
_execv
_beginthreadex
fprintf
_fdopen
_errno
malloc
sprintf
fwrite
??2@YAPAXI@Z
_setjmp3
_chmod
qsort
_ftol
fputc
??3@YAXPAX@Z
strncpy
longjmp
strrchr
_mkdir
strerror
strchr
strstr

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba5df895611866ec61bd9601595dee56

Headers

File Characteristics

Imports

kernel32

user32

gdi32

wsock32

comctl32

msvcrt

Sections

.text Size: 108KB - Virtual size: 106KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 48KB - Virtual size: 237KB

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: 108KB - Virtual size: 106KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 48KB - Virtual size: 237KB

.rsrc
Size: 8KB - Virtual size: 6KB