6504b813176bbcef47e4308d97479ead

Sharing

Copy URL Twitter E-mail

General

Target

6504b813176bbcef47e4308d97479ead
Size

60KB
MD5

6504b813176bbcef47e4308d97479ead
SHA1

550ac41d3a5f971ce86850cd2751d49985e6d06b
SHA256

e20760506ada5455961f0f4dba0f474c9d4ccfa06155ad495c3414432090ae44
SHA512

2cbaf70d81d0cbb5a9c2d8a3f021c59b0f7f5f80a21b90d7ad54d9575dd8fc2ac2c76a7ff675aa379820c265d536240871af14b803c0804077a550a95e7b02da
SSDEEP

768:SLOkg8+UAq4OwSRNFdv7QuhQ0KTM/0V6ZCqt78cVkWRe/4OT156Zf8pzvYKpCLyu:QOHp6xIww0KQvQyGZn1qim

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6504b813176bbcef47e4308d97479ead

Files

6504b813176bbcef47e4308d97479ead
.exe windows:4 windows x86 arch:x86

3f97c71ac9bfafeb9405ab571fd9412d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
strcpy
fopen
strlen
fprintf
fclose
exit
toupper
_ftol
ceil
_endthread
strcmp
strncpy
_beginthread
atoi
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
wcslen
strstr
srand
rand
_snprintf
memset
_vsnprintf
strncat

kernel32

WideCharToMultiByte
LocalFree
GetSystemTime
GetFileSize
SetFilePointer
ReadFile
FreeLibrary
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
DeleteFileA
InterlockedDecrement
WinExec
GetComputerNameA
GetLocaleInfoA
GetTickCount
Sleep
TerminateThread
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
ExitProcess
GetLastError
SetFileAttributesA
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
SetErrorMode
GetTempPathA
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersionExA
GetFileAttributesA
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
MoveFileExA
GetEnvironmentVariableA
GetShortPathNameA
lstrlenA
CloseHandle
WriteFile
CreateFileA
CreateDirectoryA
lstrcatA
GetDriveTypeA
GetLogicalDriveStringsA
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryA

user32

ShowWindow
SetClipboardData
CloseClipboard
MessageBoxA
VkKeyScanA
OpenClipboard
GetWindowThreadProcessId
BlockInput
keybd_event
SetForegroundWindow
SetFocus
FindWindowA
EmptyClipboard

ws2_32

closesocket
send
inet_addr
gethostbyname
WSAStartup
WSACleanup
recv
socket
htons
connect

wininet

InternetOpenUrlA
InternetOpenA
InternetReadFile

urlmon

URLDownloadToFileA

shell32

ShellExecuteExA
SHChangeNotify
ShellExecuteA

advapi32

RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey

ntdll

NtQuerySystemInformation
ZwSystemDebugControl

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

ole32

CoCreateInstance
CoInitialize
CoUninitialize

shlwapi

SHDeleteKeyA

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3f97c71ac9bfafeb9405ab571fd9412d

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

ws2_32

wininet

urlmon

shell32

advapi32

ntdll

oleaut32

ole32

shlwapi

Sections

.text Size: 21KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 33KB - Virtual size: 32KB

.CRT Size: 512B - Virtual size: 4B

.text
Size: 21KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 33KB - Virtual size: 32KB

.CRT
Size: 512B - Virtual size: 4B