61b86ea69d6cd5dc39aa6cdb3df79ea1

Sharing

Copy URL Twitter E-mail

General

Target

61b86ea69d6cd5dc39aa6cdb3df79ea1
Size

302KB
MD5

61b86ea69d6cd5dc39aa6cdb3df79ea1
SHA1

086af29b9334ec997eb4485cdca75194fab8b142
SHA256

26b26e9950e49d0417be36a8f0413f6fd39d4bebc0a0b3274c81efa63c9ee39e
SHA512

6b652d1862dda697760e6ff5c59695d55e32e3ce3d43aae024cd6e59208ef46acccf5a652b6522a215a92209f59463e24be6ebf5ff7ffd505f1577968246dd97
SSDEEP

6144:Za9NFt1kJ3Bod/sc84LRabzGoFsYuc+6H3Gu1VPzphKJIJhrxLbnXKKV:Za9Hi3Bod/sc8yafXFsf2XXzvfNbn6K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61b86ea69d6cd5dc39aa6cdb3df79ea1

Files

61b86ea69d6cd5dc39aa6cdb3df79ea1
.exe windows:4 windows x86 arch:x86

866c2202c21d4eb2ceb64eb46b3bcae8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharNextW
GetDC
DestroyIcon
CharUpperW
PeekMessageW
MessageBeep
GetMessageW
GetMenuItemInfoA
OffsetRect
CharPrevA
LoadMenuA
SetCapture
LoadBitmapA
CreateAcceleratorTableA
CharUpperA

ole32

CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoTaskMemFree
StringFromCLSID
CoCreateInstance

kernel32

InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
LoadResource
RaiseException
LeaveCriticalSection
IsProcessorFeaturePresent
GlobalUnlock
GetProcessHeap
EnterCriticalSection
GetSystemTimeAsFileTime
GlobalAlloc
lstrlenW
GlobalSize
HeapFree
FindResourceExW
GlobalFree
FindResourceW
GetCurrentDirectoryW
HeapDestroy
IsDBCSLeadByteEx
SwitchToThread
GetFullPathNameW
LockResource
GlobalReAlloc
CreateFileW
UnhandledExceptionFilter
FreeLibrary
IsDebuggerPresent
OutputDebugStringW
GlobalLock
SetThreadLocale
GetTempFileNameW
GetModuleHandleW
HeapReAlloc
CloseHandle
CopyFileW
DeleteFileW
SizeofResource
HeapAlloc
GetThreadLocale
HeapSize
GetCurrentThreadId
GetFileSize
DeleteCriticalSection
ReadFile
GetStartupInfoA
VirtualAlloc

oleaut32

VariantInit
SafeArrayDestroy
SysFreeString
SafeArrayLock
RegisterTypeLi
SysStringByteLen
SafeArrayGetVartype
SafeArrayGetLBound
SysStringLen
LoadRegTypeLi
SysAllocStringLen
UnRegisterTypeLi
VarBstrCat
VarBstrCmp
LoadTypeLi
GetErrorInfo
SafeArrayGetUBound
SafeArrayUnlock
VariantClear
SysAllocStringByteLen
SysAllocString

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shlwapi

PathFindFileNameW
PathRenameExtensionW
PathCombineW
PathFindExtensionW
PathCanonicalizeW
PathRemoveFileSpecW
PathIsURLW
PathRemoveExtensionW
PathStripToRootW
PathIsRelativeW
PathFileExistsW

gdi32

GetClipBox

cmutil

CmEndOfStrW
CmStrStrW
GetOSBuildNumber
CmStrTrimW
CmAtolA
CmWinHelp

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 261KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

866c2202c21d4eb2ceb64eb46b3bcae8

Headers

File Characteristics

Imports

user32

ole32

kernel32

oleaut32

version

advapi32

shlwapi

gdi32

cmutil

Sections

.text Size: 25KB - Virtual size: 24KB

.data Size: 261KB - Virtual size: 464KB

.rdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 12KB - Virtual size: 11KB

.text
Size: 25KB - Virtual size: 24KB

.data
Size: 261KB - Virtual size: 464KB

.rdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 12KB - Virtual size: 11KB