32dede29142a30050c12a59abae0e08b

General

Target

32dede29142a30050c12a59abae0e08b
Size

2.1MB
MD5

32dede29142a30050c12a59abae0e08b
SHA1

2c49af2034da78337fbe91a29dbfe2523dc51b15
SHA256

c258d22f2ce55f5adafe30e853995d6c6c0d9841fe2f03c181a5d8d7e6489bec
SHA512

6bdf5b72e464c34fab95db0cba819fc851a570d4e1bffe551ba187dd5b2af6d7c21fd8ae518e657f5fb9539e70fc6fca46e4288b4d6aa058c9f394f2fd474b90
SSDEEP

49152:sFdwfKQPC+bs8qU+e9nrEIPvKKHTH7pyYT:srwBVbfr5hgD+H78Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32dede29142a30050c12a59abae0e08b

Files

32dede29142a30050c12a59abae0e08b
.exe windows:4 windows x64 arch:x64

93090c9e6c5b3dac2375b452eeadf055

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
CloseHandle
LocalFree
LocalAlloc
OpenMutexW
CreateMutexW
lstrlenW
GetCurrentProcessId
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryW
GetModuleFileNameW
lstrcatW
GetCurrentProcess
TerminateProcess
GetStartupInfoW
Sleep

user32

EndPaint
BeginPaint
CreateWindowExW
RegisterClassExW
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
PostQuitMessage

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl

msvcr80

_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
__C_specific_handler
__wgetmainargs
_amsg_exit
wcsstr
memset

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93090c9e6c5b3dac2375b452eeadf055

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcr80

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 312B

.rsrc Size: 47KB - Virtual size: 47KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 312B

.rsrc
Size: 47KB - Virtual size: 47KB