348e0b870e0866c50576acddcdfb07c2

Sharing

Copy URL Twitter E-mail

General

Target

348e0b870e0866c50576acddcdfb07c2
Size

373KB
MD5

348e0b870e0866c50576acddcdfb07c2
SHA1

d3d4f67e3ce282f05bd336dc763b105c4178de6c
SHA256

6af1aa2d81d8c6fd78b8e97838364948b3f44adec78614dccb8b489666ba9ddc
SHA512

cdddbbb06f9c39d37897378555defbe3b3c629b49204fe5068c66b9b8728c4ef437fb19d9f6d7549f0335459cffdfd53378f64f38b1320e0b126479eade2e3bf
SSDEEP

6144:eKpXARGuf6LUT4NwuQipiJoUu7aZmtiT+MFyi6DBtm9uEIEUHRqRlRdIj3mXWgef:eieFfwsIguzE+9BtmwnRqRlRdIKG+K6U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
348e0b870e0866c50576acddcdfb07c2

Files

348e0b870e0866c50576acddcdfb07c2
.exe windows:4 windows x86 arch:x86

c9b4cff203da1fffd04b2ece95b04447

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ShowWindow
IsWindowUnicode
CloseWindow
SetWindowPlacement
SetParent
SendDlgItemMessageA
GetDlgItem
EndDeferWindowPos
IsWindowVisible
IsIconic
SetDlgItemInt
LoadCursorA

gdi32

Arc
CopyMetaFileW
EnumObjects
CreateEllipticRgn
ExtEscape
GetBkMode
AngleArc
BitBlt
ExcludeClipRect
CopyMetaFileA
GetBrushOrgEx

advapi32

RegQueryMultipleValuesA
RegUnLoadKeyA
ClearEventLogW
RegOpenKeyExA
RegSaveKeyA
RegisterEventSourceA
ReportEventA
PrivilegeCheck
RegCreateKeyA
SetTokenInformation

kernel32

SetLastError
TlsGetValue
GetLastError
HeapDestroy
HeapCreate
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
GetStringTypeA
LeaveCriticalSection
LCMapStringA
VirtualFreeEx
VirtualProtect
LocalFlags
VirtualFree
GetLocaleInfoA
IsBadStringPtrA
ReleaseSemaphore
GetDateFormatA
IsBadWritePtr
GetStringTypeW
GetCPInfoExA
HeapFree
GetPrivateProfileStringA
WritePrivateProfileStringA
GetProcAddress
SetHandleInformation
VirtualAllocEx
LCMapStringW
MultiByteToWideChar
LoadLibraryA
TlsAlloc
HeapReAlloc
VirtualAlloc
HeapAlloc
GetOEMCP
GetACP
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
GetCPInfo

winspool.drv

AddPrintProcessorA
AddPrinterDriverExA
DeletePrinterConnectionA
ConfigurePortA
SetPrinterW
EnumPrintProcessorsA
DeletePrinterDriverExA
DeletePrinterConnectionW

netapi32

NetUseDel
NetLocalGroupDelMembers
NetConfigGet
Netbios
NetGetJoinInformation
NetConnectionEnum
NetGroupAdd
NetErrorLogRead
NetGetDCName

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rft
Size: 333KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9b4cff203da1fffd04b2ece95b04447

Headers

File Characteristics

Imports

user32

gdi32

advapi32

kernel32

winspool.drv

netapi32

Sections

.text Size: 29KB - Virtual size: 29KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 79KB

.rft Size: 333KB - Virtual size: 332KB

.rsrc Size: 3KB - Virtual size: 3KB

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 79KB

.rft
Size: 333KB - Virtual size: 332KB

.rsrc
Size: 3KB - Virtual size: 3KB