5bd7e00098ca7e95e09447cfff965ef5

Sharing

Copy URL Twitter E-mail

General

Target

5bd7e00098ca7e95e09447cfff965ef5
Size

121KB
MD5

5bd7e00098ca7e95e09447cfff965ef5
SHA1

00973b4d66cced25cc99b9acc58d1422c8aa7d01
SHA256

50027b131287bf47ef2e9d08a031ddcd1d9b41768aa125888766d014c356dfe9
SHA512

efdb88286ed3d475bb4b2089b76413a4808fc619ad703231fdac47829c28e142b48dc82ed231daf95c3085a3f98b1d4f0bc5e197ff7b8724f8b3cca0ecc10b48
SSDEEP

3072:zXJqQIsn0LyUJAgAnVlm2MzdlmUfFkW4URTV:z5F1cJ3Anq2MzdlmOv46T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bd7e00098ca7e95e09447cfff965ef5

Files

5bd7e00098ca7e95e09447cfff965ef5
.exe windows:4 windows x86 arch:x86

4959621cee6b31550c820469c1bc8569

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_acmdln
__setusermatherr
fwrite
signal
fseek
__getmainargs
exit
fread
fclose
strcmp
_except_handler3
_initterm
__set_app_type
fflush
strlen
_cexit
remove
malloc
wcslen
_adjust_fdiv
fopen
free
__p__fmode
_exit
printf
_onexit
memset
__p__commode
strcpy
_XcptFilter
_strnicmp

kernel32

SystemTimeToFileTime
QueryPerformanceCounter
ExpandEnvironmentStringsA
SetHandleCount
WaitForSingleObject
GetPrivateProfileStringA
LocalFree
WideCharToMultiByte
GetProcAddress
LoadLibraryA
GetModuleHandleW
GetWindowsDirectoryA

shell32

ShellExecuteExW
Shell_NotifyIconA
ExtractIconW
SHFileOperationA
SHGetDiskFreeSpaceExW
SHGetSpecialFolderPathA
SHGetDesktopFolder
DragQueryFileA

ole32

PropVariantClear
ReleaseStgMedium
CoUninitialize
StgCreateDocfileOnILockBytes
StringFromGUID2
CoFreeUnusedLibraries
OleFlushClipboard
StgOpenStorage
StgOpenStorageOnILockBytes

advapi32

CheckTokenMembership
CryptDestroyHash
RegOpenKeyW
OpenThreadToken
OpenServiceA
QueryServiceStatus
RegEnumValueW
OpenSCManagerA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
RegDeleteValueA
CryptCreateHash
SetSecurityDescriptorGroup
InitiateSystemShutdownA

comctl32

ImageList_DrawEx
ImageList_SetDragCursorImage
ImageList_Read
ImageList_EndDrag

user32

PeekMessageA
ScreenToClient
RemoveMenu
AdjustWindowRectEx
InflateRect
RegisterWindowMessageA
EnumWindows
PostQuitMessage
ScrollWindow
DestroyWindow
RedrawWindow

gdi32

Escape
GetTextExtentPoint32A
GetTextFaceW
GetRegionData
AddFontResourceA
PolyDraw
CreateFontA
SelectPalette
Pie
GetViewportExtEx
ScaleWindowExtEx
GetBitmapBits
CreateEllipticRgn
GetDCOrgEx
CreateDIBPatternBrushPt

oleaut32

CreateErrorInfo
VariantClear
SysAllocStringLen
SafeArrayUnaccessData
LoadTypeLib
SetErrorInfo
GetErrorInfo

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4959621cee6b31550c820469c1bc8569

Headers

File Characteristics

Imports

msvcrt

kernel32

shell32

ole32

advapi32

comctl32

user32

gdi32

oleaut32

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 50KB - Virtual size: 62KB

.rsrc Size: 64KB - Virtual size: 64KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 50KB - Virtual size: 62KB

.rsrc
Size: 64KB - Virtual size: 64KB