536163ca66418689b2c39bfd2fd9750b

Sharing

Copy URL Twitter E-mail

General

Target

536163ca66418689b2c39bfd2fd9750b
Size

176KB
MD5

536163ca66418689b2c39bfd2fd9750b
SHA1

fa848433007dc3f2f62935e09d0af86c6d01e893
SHA256

e34e4e624dba3b35a26e950f195a5167751501763e222f76e0b3b8cb8a51eeb6
SHA512

24318096866395f1aabebfb1cff3f843af74f0bc89d7723490b380cf488390582adc0792777b21f67c9ac601ae6873ead223a1252a85219b58a241096462f667
SSDEEP

3072:R9KBAaOD9EX4v0o2fzUbaD7AKea/EVIJ/xFL6RqX/4cB236dALV4pay8M07yC:UrU98o2fzCezeasVG/XoqP4t36dopL7J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
536163ca66418689b2c39bfd2fd9750b

Files

536163ca66418689b2c39bfd2fd9750b
.exe windows:4 windows x86 arch:x86

e51d6b724af47b068d7e810318c69098

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreate

ole32

CoUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance
StringFromGUID2
CoSetProxyBlanket

shlwapi

SHDeleteKeyW

shell32

SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW

advapi32

RegCreateKeyExW
RegCloseKey
RegSetValueExW

kernel32

TerminateProcess
IsDebuggerPresent
GetStringTypeA
SetHandleCount
EnterCriticalSection
GetLocaleInfoA
GetThreadPriority
SetFilePointer
GetConsoleMode
GlobalAlloc
GetSystemTimeAsFileTime
GetCommandLineA
TlsGetValue
GetCurrentProcess
VirtualFree
SetLastError
RtlUnwind
GetModuleHandleA
EnumSystemLocalesA
LCMapStringA
GetConsoleCP
HeapSize
HeapAlloc
GetVersionExA
GetProcAddress
GetProcessHeap
CloseHandle
FreeEnvironmentStringsW
SetCommTimeouts
IsValidLocale
RaiseException
HeapFree
FreeEnvironmentStringsA
GetCPInfo
GetLastError
SetEndOfFile
WriteConsoleW
VirtualAlloc
IsValidCodePage
HeapCreate
GetConsoleOutputCP
GetStringTypeW
GetACP
TlsFree
SetUnhandledExceptionFilter
DeleteCriticalSection
FlushFileBuffers
EnumResourceNamesA
GetEnvironmentStringsW
GetLocaleInfoW
HeapReAlloc
WriteConsoleA
GetCurrentDirectoryW
GetCurrentProcessId
LCMapStringW
MultiByteToWideChar
QueryPerformanceCounter
InterlockedDecrement
HeapDestroy
Sleep
WriteFile
GetModuleFileNameA
GetOEMCP
WideCharToMultiByte
InterlockedIncrement
ReadFile
InitializeCriticalSection
GetUserDefaultLCID
ExitProcess
LoadLibraryA
ExitProcess
GetEnvironmentStrings
GetStdHandle
TlsAlloc
LeaveCriticalSection
UnhandledExceptionFilter
GetCurrentThreadId
TlsSetValue
GetFullPathNameW
CreateFileA
GetModuleFileNameW
GetFileType
GetTickCount
SetStdHandle
GetStartupInfoA
GetFullPathNameA

user32

GetClassLongA
MessageBoxW

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e51d6b724af47b068d7e810318c69098

Headers

File Characteristics

Imports

rpcrt4

ole32

shlwapi

shell32

advapi32

kernel32

user32

Sections

.text Size: 148KB - Virtual size: 148KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 23KB - Virtual size: 23KB

.crt Size: 512B - Virtual size: 212KB

.text
Size: 148KB - Virtual size: 148KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 23KB - Virtual size: 23KB

.crt
Size: 512B - Virtual size: 212KB