5f390227b6f834fd2407e2500f953767

Sharing

Copy URL Twitter E-mail

General

Target

5f390227b6f834fd2407e2500f953767
Size

197KB
MD5

5f390227b6f834fd2407e2500f953767
SHA1

a58f1a9857a865312ceebfe499fd0a76e60a4024
SHA256

e0922aa0e97aafbf98f19ca7c781a55625aed05d9ca4aea1df43c20eea0d8edd
SHA512

77935fb2425e15cac74abb7e7c3fca09d3ee7b8d1a3ad07048af97ab657e4eb2f372382d0b8a1f83d37ef2714faf1a9c90a3f48cac0775069ff00921b942c97f
SSDEEP

6144:v2KzcDWtcTsmeYrPw4yI7FXYhwUptWVJB:eKzcqtcaYByhwUKV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f390227b6f834fd2407e2500f953767

Files

5f390227b6f834fd2407e2500f953767
.exe windows:4 windows x86 arch:x86

050d6ef08d4e087a1938e8f7b3c0ca84

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvfw32

ICInfo

kernel32

GetSystemDirectoryA
LocalFree
_llseek
EnterCriticalSection
GetTempFileNameW
SetLastError
HeapReAlloc
GetCurrentThreadId
HeapAlloc
EndUpdateResourceW
DeleteCriticalSection
CreateFiberEx
IsDebuggerPresent
CreateDirectoryA
DebugBreak
LoadLibraryExA
SetFileAttributesA
GetLastError
LockResource
UnmapViewOfFile
UpdateResourceW
GetVersion
RaiseException
FindClose
GetCommandLineW
OutputDebugStringA
EscapeCommFunction
UnhandledExceptionFilter
RemoveDirectoryA
GetStringTypeExW
CreateFileW
QueryPerformanceCounter
CreateFileA
CloseHandle
LoadLibraryExW
SetEndOfFile
WideCharToMultiByte
ReadFile
EnumResourceTypesW
MultiByteToWideChar
FindResourceExW
FindNextFileA
GetFullPathNameA
_lwrite
GetACP
GetFileAttributesW
HeapFree
GlobalAlloc
EnumResourceNamesA
FreeResource
GetTickCount
_lread
_lclose
GetFileSize
GetModuleHandleW
WriteFile
InterlockedExchange
DeleteFileA
BeginUpdateResourceW
GetCurrentProcessId
MoveFileW
InitializeCriticalSection
RemoveDirectoryW
MapViewOfFile
DeleteFileW
GetFullPathNameW
CreateDirectoryW
lstrcmpiA
GetFileAttributesA
GetLocaleInfoA
GetTempPathW
GetProcessHeap
EnumResourceNamesW
InterlockedDecrement
FindResourceW
CreateFileMappingA
GetThreadLocale
ExitProcess
GetEnvironmentVariableA
GlobalFree
GetOEMCP
FatalExit
InterlockedIncrement
lstrlenW
HeapDestroy
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetVersionExW
GetCurrentDirectoryW
FindFirstFileA
CopyFileW
FindNextFileW
GetCurrentProcess
SetFileAttributesW
AreFileApisANSI
LoadResource
CopyFileA
GlobalLock
EnumResourceLanguagesW
LeaveCriticalSection
InterlockedCompareExchange
HeapSize
SizeofResource
SetFilePointer
lstrlenA
LoadLibraryA
GetFileInformationByHandle
FindFirstFileW
GetProcAddress
Sleep
FormatMessageW
FreeLibrary
GetVersionExA
GlobalUnlock
TerminateProcess
lstrcpyA

advapi32

CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
CryptReleaseContext
CryptHashData
CryptDestroyHash

shell32

CommandLineToArgvW

imagehlp

ImageGetDigestStream
ImageNtHeader
ImageRvaToVa
ImageDirectoryEntryToData

psapi

GetProcessMemoryInfo

user32

MonitorFromWindow
CharNextA
wsprintfW
CharNextW

Sections

.text
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lib
Size: 512B - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

050d6ef08d4e087a1938e8f7b3c0ca84

Headers

File Characteristics

Imports

msvfw32

kernel32

advapi32

shell32

imagehlp

psapi

user32

Sections

.text Size: 168KB - Virtual size: 168KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 23KB - Virtual size: 23KB

.lib Size: 512B - Virtual size: 228KB

.text
Size: 168KB - Virtual size: 168KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 23KB - Virtual size: 23KB

.lib
Size: 512B - Virtual size: 228KB