621c4ccb3ec0d08423ed823f166820ef

Sharing

Copy URL

Twitter E-mail

General

Target

621c4ccb3ec0d08423ed823f166820ef
Size

64KB
MD5

621c4ccb3ec0d08423ed823f166820ef
SHA1

87abd67f62e99370930ba16229e16e453189fb1b
SHA256

79fc6fbc1e3c4fa8e2e077540d1561b9d9eb4bc640fd3bb81f591146e497a8c6
SHA512

4aecd1fc70b69ed5bc1c0dd23122543da4f2fa5b81a4a145e12909d8c57d81e0902b95e06eae8b6afdbcc334772d3333e9eacd07b1b610393cb77d43b0001257
SSDEEP

1536:o8/eeXOSQ3qDPXV9LPugzAfbFBoP+qEE108CC:o8xXOSQ3qTPLPugzwBBbq2jC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
621c4ccb3ec0d08423ed823f166820ef

Files

621c4ccb3ec0d08423ed823f166820ef
.exe windows:5 windows x86 arch:x86

237d85424893d9ef66bb78a3abf2d740

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ulib

?NewBuf@FSTRING@@UAEEK@Z
??0BYTE_STREAM@@QAE@XZ
?Fatal@PROGRAM@@UBAXKKPADZZ
??1FSN_FILTER@@UAE@XZ
??0LIST@@QAE@XZ
?Initialize@PATH@@QAEEPBV1@E@Z
?LogMessage@MESSAGE@@QAEEPBVWSTRING@@@Z
??0FSTRING@@QAE@XZ
?NewBuf@BDSTRING@@UAEEK@Z
??1PROGRAM@@UAE@XZ
??0OBJECT@@QAE@ABV0@@Z
?Cast@FILE_STREAM@@SGPAV1@PBVOBJECT@@@Z
??0BITVECTOR@@QAE@XZ
?Cast@KEYBOARD@@SGPAV1@PBVOBJECT@@@Z
??0TIMEINFO@@QAE@XZ
?AppendBase@PATH@@QAEEPBVWSTRING@@E@Z
?WaitForUserSignal@MESSAGE@@UAEEXZ
?QuerySTR@BSTRING@@QBEPADKKPADKE@Z
?Cast@SCREEN@@SGPAV1@PBVOBJECT@@@Z
??_7WSTRING@@6B@
??0FSTRING@@QAE@ABV0@@Z

kernel32

GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetCurrentThreadId
GetModuleHandleW
RegisterWaitForSingleObjectEx
GetConsoleCommandHistoryLengthW
OpenJobObjectA
CreateRemoteThread
LoadLibraryA
AddAtomA
SetFilePointer
GetPriorityClass
ExitThread
Sleep
LoadModule
RegisterConsoleVDM
SetEvent
QueryPerformanceCounter
CreateEventA
CommConfigDialogW
EnumResourceTypesW
GetFileAttributesA
GlobalSize

ntdll

_wcslwr
NlsMbOemCodePageTag
RtlUpcaseUnicodeToCustomCPN
NtFindAtom
RtlCreateQueryDebugBuffer
ZwWaitLowEventPair
wcsstr
RtlDoesFileExists_U
RtlSetIoCompletionCallback
RtlUpcaseUnicodeChar
ZwCreateThread
NtClose
NtReplyWaitReceivePortEx
RtlConvertSharedToExclusive
ZwQuerySecurityObject

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 853B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

237d85424893d9ef66bb78a3abf2d740

Headers

DLL Characteristics

File Characteristics

Imports

ulib

kernel32

ntdll

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 1024B - Virtual size: 853B

.data Size: 2KB - Virtual size: 30KB

.rsrc Size: 1024B - Virtual size: 1008B

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 1024B - Virtual size: 853B

.data
Size: 2KB - Virtual size: 30KB

.rsrc
Size: 1024B - Virtual size: 1008B