3269f223064b7a3973ebe765f0622801

Sharing

Copy URL Twitter E-mail

General

Target

3269f223064b7a3973ebe765f0622801
Size

228KB
MD5

3269f223064b7a3973ebe765f0622801
SHA1

c9fa3808ff2075eea34cda34c20ad3c149135de4
SHA256

8f7a01245ba0c14a3a59ac0881ffcc48cb9e84377e89e2f87eb495bd8c73e44a
SHA512

b122e9ff44cff0e05f1d4f6ed489c69c3ed60eb7d2dbcf8db48f54130660edf8cef8ba3f331a284e9ba41eea49dbce2bfe53c278f75c7194809df06af8618832
SSDEEP

3072:/Xy8tbzCCo7hUy/ZuCFl+qnhTweftQ2kYI+1LdDWLrGsAMcrvIylrmFAg:Py8tMl3GKL1aKjVY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3269f223064b7a3973ebe765f0622801

Files

3269f223064b7a3973ebe765f0622801
.exe windows:4 windows x86 arch:x86

8d466e961b5f5c352ee3781a2ee0fa8a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord927
ord940
ord942
ord2606
ord4273
ord539
ord5568
ord6655
ord4124
ord5706
ord537
ord823
ord825
ord538
ord858
ord2910
ord540
ord861
ord535
ord800

msvcrt

exit
malloc
sprintf
sscanf
wcschr
wcsstr
wcscpy
fflush
fclose
_wfopen
fseek
ftell
fread
fwrite
wcstol
memmove
realloc
_wtoi
__CxxFrameHandler
wcsrchr
swprintf
wcscat
strchr
_strdup
memset
wcsncat
wcsncpy
memcmp
_snprintf
memcpy
_snwprintf
free
strstr
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
wcscmp
time
wcslen
strncpy
strncat
strlen
gmtime
getenv
_ftol
memchr
_stricmp
_sys_nerr
strerror
_beginthreadex
fputc
fputs
qsort
fgets
strncmp
_isctype
__mb_cur_max
_pctype
strtol
tolower
strtoul
_errno
strrchr
_stati64
_iob
fopen
calloc
_wcsicmp
_wcsset

kernel32

LocalAlloc
LocalLock
MultiByteToWideChar
WideCharToMultiByte
GetWindowsDirectoryW
CopyFileW
GetModuleFileNameW
CloseHandle
WriteFile
CreateFileW
GetModuleHandleW
ReadFile
SetFilePointer
GetLastError
LocalFree
GetDiskFreeSpaceW
SetFileAttributesW
CreateDirectoryW
ExpandEnvironmentStringsA
FormatMessageA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
WaitForSingleObject
SleepEx
InitializeCriticalSection
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LocalUnlock
GetFileAttributesW
GetACP
GetTickCount
DeviceIoControl
GetFileSize
FormatMessageW
GetTempPathW
GetVersionExW
CreateMutexW
Sleep
DeleteFileW
MoveFileW
GetCurrentProcessId
OpenProcess
TerminateProcess
ExitProcess

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

winmm

timeSetEvent
timeKillEvent

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

CoInitialize
CoCreateGuid
CoUninitialize

ws2_32

htons
bind
connect
setsockopt
getsockopt
WSASetLastError
ntohs
inet_ntoa
getsockname
recv
send
socket
WSAGetLastError
WSAStartup
WSACleanup
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
__WSAFDIsSet
select
gethostname
getpeername
ioctlsocket
closesocket

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d466e961b5f5c352ee3781a2ee0fa8a

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

advapi32

shell32

winmm

version

ole32

ws2_32

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 36KB - Virtual size: 40KB

.CRT Size: 4KB - Virtual size: 12B

.rsrc Size: 4KB - Virtual size: 1008B

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 36KB - Virtual size: 40KB

.CRT
Size: 4KB - Virtual size: 12B

.rsrc
Size: 4KB - Virtual size: 1008B