5df98504f87ffbb7b9fd45f291ecd0ca

Sharing

Copy URL Twitter E-mail

General

Target

5df98504f87ffbb7b9fd45f291ecd0ca
Size

46KB
MD5

5df98504f87ffbb7b9fd45f291ecd0ca
SHA1

921c9bdca2018ef20633b8b67d443b12ec5eaaa3
SHA256

7c976639b3126ae8dc90a032ea2aa962df181381a7e8fb06e621400ea05b7801
SHA512

0f056bd677a8196757c59d0e705d3b0a0b908f360201c5c6699327870bf38f631069b1ea656858bba48b69791d47aca4bca2ab165fe9c94e4e212604f3cbe726
SSDEEP

768:fSdGsqfA+WTGFuT/PAxmj6S6yBeFC/zaKjD+0X+m4RdJMy4Kj5N6XD5cHQJ5:UqoVGFurPAMXbd/zJjDxN4fJLmXDay

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5df98504f87ffbb7b9fd45f291ecd0ca

Files

5df98504f87ffbb7b9fd45f291ecd0ca
.exe windows:0 windows x86 arch:x86

ef08f57c1e7c75cc1c48b987b83ea620

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

apphelp

SdbTagToString
SdbTagRefToTagID
SdbFindNextTag
SdbInitDatabase
ApphelpCheckRunApp
SdbGetStringTagPtr
SdbEnumMsiTransforms
SdbGetEntryFlags
SdbReadBYTETagRef
SdbTagIDToTagRef
GetPermLayers
SdbGetBinaryTagData
ApphelpCheckInstallShieldPackage
SdbReadBYTETag
SdbGetDatabaseMatch
SdbUnregisterDatabase
SdbQueryFlagInfo
ApphelpFreeFileAttributes
ApphelpQueryModuleData
SdbReadBinaryTag
SdbGetTagDataSize
ApphelpCheckIME
ShimDumpCache
SdbReadWORDTagRef
SdbReadStringTag
SdbRegisterDatabase
SdbFindNextTagRef
ApphelpCheckExe
SdbFreeFlagInfo
SdbGetDatabaseVersion
SdbGrabMatchingInfo
SdbReadMsiTransformInfo
SdbFindFirstMsiPackage_Str
ApphelpUpdateCacheEntry

advpack

DoInfInstall
RunSetupCommand
UserUnInstStubWrapper
TranslateInfStringEx
OpenINFEngine
FileSaveMarkNotExist
TranslateInfString
DelNode
RegInstall
IsNTAdmin

kernel32

InterlockedPushEntrySList
GetFileTime
GetLocalTime
VirtualFree
lstrcpynA
CloseHandle
VirtualAllocEx
InterlockedExchangeAdd
CompareStringA
FileTimeToSystemTime
WaitNamedPipeA
CreateMailslotA
lstrcpyA
FileTimeToLocalFileTime
GetVersion
GetLastError
ReadFileEx
ReleaseMutex
OpenMutexA
ReadFile
SetFilePointer
InterlockedPopEntrySList
WaitForMultipleObjects
WriteFileGather
GetNamedPipeHandleStateA
SetNamedPipeHandleState
lstrcmpA
ReadFileScatter
CreateFileA
GetStringTypeExA
ConnectNamedPipe
GetSystemTimes
CreateMutexA
CallNamedPipeA

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ef08f57c1e7c75cc1c48b987b83ea620

Headers

DLL Characteristics

File Characteristics

Imports

apphelp

advpack

kernel32

Sections

.text Size: 20KB - Virtual size: 20KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 23KB - Virtual size: 56KB

.text
Size: 20KB - Virtual size: 20KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 23KB - Virtual size: 56KB