36640cdef8bba8530d7bb597c1f58d68

Sharing

Copy URL Twitter E-mail

General

Target

36640cdef8bba8530d7bb597c1f58d68
Size

135KB
MD5

36640cdef8bba8530d7bb597c1f58d68
SHA1

469c86a54a7c5adcfa94379f0f28c28c74336a85
SHA256

57f6a1f6eaf5559211c045d9f51b4de2ed9343eb23c298c1dc0dfa0c9dcb3a59
SHA512

ed60ffe8c8620592ded458af2209248c13b671bed2266d3ff9844448348ac2c889b9a519a96ceb2e284078c56a0b3f5af85a1ee2bb88a651a0ffd517f7ca3f25
SSDEEP

3072:DXdMpB4kyr/5CCunEswFGBcnqKNFvJGPULKTM:DXR3jLlMc5FIPcK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36640cdef8bba8530d7bb597c1f58d68

Files

36640cdef8bba8530d7bb597c1f58d68
.exe windows:5 windows x86 arch:x86

72389e6b2ecbe3758b5d58d2b79926fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnregisterWaitEx
GetNumberOfConsoleMouseButtons
GetConsoleMode
WriteConsoleOutputW
GetSystemTimeAsFileTime
GetProcessVersion
SetConsoleTitleW
GetThreadPriority
SetLocalTime
GetCommProperties
EnumDateFormatsExW
GetSystemInfo
SetMailslotInfo
VirtualAlloc
CreateDirectoryExW
GetDefaultCommConfigA
GetConsoleAliasesW
SetFirmwareEnvironmentVariableA
LocalCompact
InitializeCriticalSection
LoadLibraryA

mapi32

MAPIUninitialize@0
HrDecomposeMsgID@24
FBadRglpNameID@8
MNLS_CompareStringW@24
FBadRglpszA@8
HrValidateIPMSubtree@20
PropCopyMore@16
SetAttribIMsgOnIStg@16
BMAPIDetails
ScCountNotifications@12
MAPIAllocateBuffer@8
HrAddColumnsEx@20
MNLS_lstrcmpW@8
MAPIOpenFormMgr
MAPILogonEx@20
cmc_logoff
UNKOBJ_ScAllocateMore@16
MAPILogon
FPropExists@8
FtMulDwDw@8
MAPIDeinitIdle@0
RTFSync
MAPIAddress

netapi32

NetSessionEnum
NetpIsRemote
DsGetDcNameA
NetServerGetInfo
NetReplImportDirUnlock
RxNetAccessGetUserPerms
NetWkstaGetInfo
NetpOpenConfigData
DsGetDcNameW
I_NetLogonSamLogon
I_NetAccountSync
NetDfsRemove
NetpwNameCanonicalize
DsEnumerateDomainTrustsW
NetpwPathType
NetErrorLogClear

ntdll

LdrLockLoaderLock
_ltow
ZwPrivilegedServiceAuditAlarm
wcstombs
RtlRunDecodeUnicodeString
ZwAllocateUuids
ZwAccessCheckByTypeResultListAndAuditAlarm
RtlMultiByteToUnicodeSize
RtlFreeThreadActivationContextStack
ZwResumeProcess
RtlUnhandledExceptionFilter
NtTraceEvent
_vsnprintf
RtlCheckForOrphanedCriticalSections
ZwRaiseException

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72389e6b2ecbe3758b5d58d2b79926fd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

mapi32

netapi32

ntdll

Sections

.text Size: 116KB - Virtual size: 115KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 171KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 916B

.text
Size: 116KB - Virtual size: 115KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 171KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 916B