4d120f9724a66a53c0e49a65ecd9a8ea

Sharing

Copy URL Twitter E-mail

General

Target

4d120f9724a66a53c0e49a65ecd9a8ea
Size

88KB
MD5

4d120f9724a66a53c0e49a65ecd9a8ea
SHA1

2e9e5faa6295dc8d8af093c56a5e92bf535c5c7a
SHA256

17e96dcd43f30fb48d7d3d23012f2dd453514ee1f891e8843ee0e2c5ff20a19e
SHA512

495621f083bf86a69496fedb2a8617741624f660a04ab4ca5fd507ed4dd32c07bfffa2c8f316f71b0e5256f64927fe7d7ea4507e2ba8ca17f8b107dbe2028a3b
SSDEEP

768:lWPbJ5N+g2IxXVfr9wLyHwdSna9TbmU9y5b2p5DaBwIH0FC4DrD:lWPbs+0yHM9OiNrFD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d120f9724a66a53c0e49a65ecd9a8ea

Files

4d120f9724a66a53c0e49a65ecd9a8ea
.exe windows:4 windows x86 arch:x86

2e49bdc2f6b744f673543a1529783a2c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeA
MultiByteToWideChar
InterlockedExchange
RtlUnwind
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetStdHandle
GetLocaleInfoA
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW
HeapSize
FlushFileBuffers
GlobalGetAtomNameA
GlobalHandle
GlobalFree
GlobalAlloc
VirtualQuery
GlobalLock
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetFilePointer
HeapAlloc
LoadLibraryA
CloseHandle

user32

RegisterClassA
CreateWindowExA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
SetFocus
DefWindowProcA
MessageBoxA
UpdateWindow
BringWindowToTop
SetDlgItemTextA
SetWindowTextA
ShowWindow
PostQuitMessage
DestroyWindow
SetWindowLongA
GetWindowLongA
PostMessageA

glcodage

isPrefixChar
To_2_oct
To_4_oct
DecodeChamps
DecodeEntiers
DecodeFloats
DecodeStrings
DecodeChaines
DecodeMnemoSico
De_octet_2

gloutil

LireDefSLE
LireNombreDefSLE
GlClientInitiateDDE
hOutilCreateDialog
OutilGetRCLangue
OutilGetRCSousLangue
GlClientDdeRapide
EcrireDefRafSLE
LireDefRafSLE
GlClientGetPointeur

Sections

.text
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e49bdc2f6b744f673543a1529783a2c

Headers

File Characteristics

Imports

kernel32

user32

glcodage

gloutil

Sections

.text Size: 56KB - Virtual size: 54KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 12KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 56KB - Virtual size: 54KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 12KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB