5f936168fc4bdb795bc1fe1eb04bd0b5

Sharing

Copy URL Twitter E-mail

General

Target

5f936168fc4bdb795bc1fe1eb04bd0b5
Size

128KB
MD5

5f936168fc4bdb795bc1fe1eb04bd0b5
SHA1

04cf90872142815843ccc7eb9b24f7c3ccff6f63
SHA256

2c06dbffefbf86a8635d155524ef7c5b099c1fda581f4e4896e481059c853663
SHA512

045042ec20d8efe74fd270925fdb42c6f5ec160af6aa86434aff09299cd173c5ec0ad89452c3290faee7c3a2ebb75b29f5642e9155d461b728f4bb2dc97641f2
SSDEEP

3072:WO06ocBgqdUlfZgSpi+0i9KcOvTWiIqFTHGubbKs75:WtCBMHni+0SKcsjFqubbKs7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f936168fc4bdb795bc1fe1eb04bd0b5

Files

5f936168fc4bdb795bc1fe1eb04bd0b5
.exe windows:4 windows x86 arch:x86

2db47be23a09c3c98d8256fbec60c0a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
HeapFree
HeapDestroy
HeapAlloc
GetVersionExA
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetCurrentProcessId
GetCurrentProcess
EnterCriticalSection
DeleteCriticalSection
CreateThread
InterlockedCompareExchange
CreateEventA
CloseHandle
GetProcAddress
ExitProcess
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
HeapReAlloc
VirtualAlloc
GetOEMCP
GetACP
GetStringTypeW
GetCPInfo
WriteFile
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LeaveCriticalSection
LocalAlloc
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
GetEnvironmentStrings
ReadFile
Sleep
UnhandledExceptionFilter
lstrcmpiA
CreateFileA
lstrlenA
RtlUnwind
VirtualFree
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapCreate

user32

PeekMessageA
wsprintfA
GetParent
BeginPaint
KillTimer
MessageBoxA
GetWindowTextLengthA
PostMessageA
PostQuitMessage
SetTimer
TranslateMessage

advapi32

RegEnumKeyExA
SetEntriesInAclA
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
GetLengthSid
GetTokenInformation
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExA
RegEnumValueA
RegQueryValueExA
RegOpenKeyA
RegQueryInfoKeyA

ole32

OleRun

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2db47be23a09c3c98d8256fbec60c0a9

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 100KB - Virtual size: 97KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 100KB - Virtual size: 97KB

.reloc
Size: 4KB - Virtual size: 1KB