61941a706204338ad9c4e436fb03ec92

Sharing

Copy URL Twitter E-mail

General

Target

61941a706204338ad9c4e436fb03ec92
Size

133KB
MD5

61941a706204338ad9c4e436fb03ec92
SHA1

628e20a4c993e166b518514f40d114c673777b04
SHA256

eac20547b013b0fe03c4931ac9049c58ab95b926b18c26a4d725fab45e11d492
SHA512

0b9e8f39ed31a59b40f535b6f0490850f878d326b817ceddc4c8eb0c9c0b83dd595965baacfb20c2713d06b53bf0b34da5605db9177e3a5267f4ddb7842fec8c
SSDEEP

1536:7WC5oXt6T5rVngJFgt0hlHIkL1F8iKjJKpbFd/T4yOkgmUWnenLPZ3NO2iLG4sCe:7iXMT55g8tKBIu8iz4yL9L8BNO+jCe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61941a706204338ad9c4e436fb03ec92

Files

61941a706204338ad9c4e436fb03ec92
.exe windows:4 windows x86 arch:x86

01536cf4d35504616ae89ffb932b4e0e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

VirtualProtect
GetTempPathW
InterlockedExchange
Sleep
GetStartupInfoA
GetOEMCP
SetUnhandledExceptionFilter
GetSystemInfo
VirtualQuery
GetModuleHandleA
SetEnvironmentVariableA
GetTempPathA
GetEnvironmentVariableA

msvcrt

_initterm
_exit
__setusermatherr
_except_handler3
__p__commode
_adjust_fdiv
__getmainargs
_fstat
__set_app_type
getenv
exit
_XcptFilter
__p__fmode
wcscspn
_stat
_acmdln
log
_CIpow

user32

RegisterClassA
SetWindowTextA
GetMenuItemCount
MapWindowPoints
SetScrollRange
ReleaseDC
CreatePopupMenu
EnableMenuItem
GetCursorPos
CreateWindowExA
SetClassLongA

oleaut32

VariantInit
GetErrorInfo
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantClear
SysFreeString
SafeArrayRedim

version

GetFileVersionInfoSizeW
VerInstallFileW
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueW
VerLanguageNameA

gdi32

RealizePalette
GetCurrentPositionEx
CreateDIBPatternBrushPt
PlayMetaFile
MoveToEx

comctl32

ImageList_GetImageInfo
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_SetOverlayImage

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHBindToParent
DragQueryFileW
SHBrowseForFolder
ShellExecuteExW
DragAcceptFiles
SHGetSpecialFolderLocation

ole32

StgOpenStorageOnILockBytes
CoGetMalloc
CoInitializeEx
CoRegisterMessageFilter
OleFlushClipboard
IsEqualGUID
OleRun
OleGetClipboard
StgCreateDocfileOnILockBytes
IsAccelerator
OleSetClipboard

advapi32

OpenServiceW
RegQueryValueA
AdjustTokenPrivileges
RegSetValueExW
RevertToSelf
DeregisterEventSource
CryptCreateHash
RegDeleteKeyW
OpenServiceA
OpenSCManagerW
RegQueryValueExW

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01536cf4d35504616ae89ffb932b4e0e

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

oleaut32

version

gdi32

comctl32

shell32

ole32

advapi32

Sections

.text Size: 64KB - Virtual size: 63KB

.data Size: 47KB - Virtual size: 47KB

.rsrc Size: 20KB - Virtual size: 20KB

.text
Size: 64KB - Virtual size: 63KB

.data
Size: 47KB - Virtual size: 47KB

.rsrc
Size: 20KB - Virtual size: 20KB