2e3dd6a47c751f2d563ea36293ee1b33

General

Target

2e3dd6a47c751f2d563ea36293ee1b33
Size

597KB
MD5

2e3dd6a47c751f2d563ea36293ee1b33
SHA1

43dce954f924b1d8cb6d979dfd8536d3b26e945b
SHA256

eb06c4051b80473d64e5632f96dbb2b5114526da3eb52580c4d8f2aa1650e7dd
SHA512

ee173be2a10bc917da63115d1946820070b607058bbfb61168f7dd23f8e38c1ddccc63781a112e337f279d7f58c12e7c3a6c8a0d83d1b310991e75d9b5c2db4a
SSDEEP

12288:TJWsTrkACfe6M0lJUA0PhS8pYpLvTUj0GWoTrEPtgTeHo:TdTr/0bM0luPhLYhvg5PT4FoV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e3dd6a47c751f2d563ea36293ee1b33

Files

2e3dd6a47c751f2d563ea36293ee1b33
.exe windows:5 windows x86 arch:x86

b15d7e7c004117bbf1f1488246c0ba5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

_strcmpi
RtlAdjustPrivilege
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtProtectVirtualMemory
NtFreeVirtualMemory
_chkstk
_snprintf
_vsnprintf
strncmp
_strlwr
memset
memcpy
NtQueryInformationFile
strstr

kernel32

GetFileSize
GetModuleFileNameA
CreateMutexA
SetEnvironmentVariableA
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
OpenProcess
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
Process32Next
Sleep
ExitProcess
SetLastError
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
HeapValidate
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
MoveFileExA
FindFirstFileA
QueryDosDeviceA
GetLogicalDriveStringsA
WriteFile
CloseHandle
SetFilePointer
SetFileAttributesW
GetFileAttributesW
ReadFile
SizeofResource
LoadResource
FindResourceExA
WideCharToMultiByte
MultiByteToWideChar
HeapReAlloc
IsBadReadPtr
OutputDebugStringA
GetCurrentThreadId
GetLastError
GetProcAddress

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 282KB - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b15d7e7c004117bbf1f1488246c0ba5a

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 301KB - Virtual size: 301KB

.rsrc Size: 282KB - Virtual size: 281KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 301KB - Virtual size: 301KB

.rsrc
Size: 282KB - Virtual size: 281KB

.reloc
Size: 1KB - Virtual size: 1KB