5d1f38cf355b4a118b83fa5b881f327f

Sharing

Copy URL

Twitter E-mail

General

Target

5d1f38cf355b4a118b83fa5b881f327f
Size

60KB
MD5

5d1f38cf355b4a118b83fa5b881f327f
SHA1

62982aef390a93e295bd1bc9824baad7905568a9
SHA256

cf3d7a91aec590f5edd94355f3c7e8e80ec3a06ed12d04306ab2dd214051539f
SHA512

8030a78dafec0a9484b6b08df3c2092dcc32bea297ebdea55e6d875c89c23e2c872c0e3f39b05784b5e975cdb1209ad811be1c85b515c2c293c5eb609b79077c
SSDEEP

768:th/aMCuumMOqgug7VnYxKWuENXvekvI5JhojaWeBZwVzlDJ28TqWyoZ0oRcg9:tDCunVnLWFvI7mOWeBZwBlDYBodRcg9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d1f38cf355b4a118b83fa5b881f327f

Files

5d1f38cf355b4a118b83fa5b881f327f
.exe windows:4 windows x86 arch:x86

f4ff58b23977f7f797a43fd5258fc072

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
Process32Next
Module32Next
Module32First
CloseHandle
Process32First
CreateToolhelp32Snapshot
DeleteFileA
FindClose
FindFirstFileA
Sleep
TerminateProcess
OpenProcess
SetFileTime
GetFileTime
CreateFileA
GetCurrentProcess
CopyFileA
GetModuleFileNameA
GetCurrentProcessId
FindNextFileA
LocalFree
LocalAlloc
GetProcAddress
GetComputerNameA
GetSystemInfo
FreeLibrary
GetWindowsDirectoryA
GetModuleHandleA
GetSystemDirectoryA
GetSystemTimeAsFileTime
ReadFile
GetVersion
ExitProcess
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
GetOEMCP
SetEnvironmentVariableA
lstrcmpA
GetACP
GetCPInfo
FlushFileBuffers
GetStdHandle
SetHandleCount
VirtualAlloc
MultiByteToWideChar
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetStartupInfoA
GetCommandLineA
SetStdHandle
HeapFree
GetLastError
HeapAlloc
WideCharToMultiByte
HeapReAlloc
WriteFile
GetEnvironmentStrings
GetFileType
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind

advapi32

RegSetValueExA
GetUserNameA
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyA
RegEnumValueA
RegCloseKey

user32

wsprintfA
LoadStringA

wsock32

gethostname
WSAStartup
socket
closesocket
WSACleanup
gethostbyname
ntohl
recv
send
WSAGetLastError
connect
htons

shell32

ShellExecuteA

rasapi32

RasEnumConnectionsA

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f4ff58b23977f7f797a43fd5258fc072

Headers

File Characteristics

Imports

kernel32

advapi32

user32

wsock32

shell32

rasapi32

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 4KB