672a636c59ca802d0c9a729856b1e517

Sharing

Copy URL Twitter E-mail

General

Target

672a636c59ca802d0c9a729856b1e517
Size

160KB
MD5

672a636c59ca802d0c9a729856b1e517
SHA1

534c6d5fe2477d52f42ab610814ffec1015c187c
SHA256

e4bbb040eead5d71cbf5b56d930b26adb48f9dae7fbc31c8861efa1bbb571160
SHA512

457dc3c82bf5aca81b1e6704def82ff3b4b589371e4cdd8542eb79325dea1001a387b4b40eb255cd77de89cf7287d785ee4ef6947c65f3b053e955a92e40fd75
SSDEEP

3072:m5lfcsEuGznQOuRaCzZ72zWEaOSTocFb4mlm9LkauS1Xzq4HuYJf:+lfcsERndOaCUWD1To44lLAW0Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
672a636c59ca802d0c9a729856b1e517

Files

672a636c59ca802d0c9a729856b1e517
.exe windows:5 windows x86 arch:x86

11e376b42ccb598b5cabc196bcf9ee23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetStdHandle
CreateEventA
VirtualAlloc
CreateMutexA
CreateSemaphoreA
GetOEMCP
GetACP
GetStartupInfoW
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
Sleep
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA

gdi32

GetTextFaceA
SetTextAlign
GetTextAlign
AbortDoc
GetTextColor
SetTextColor
GetRasterizerCaps
TextOutA

crypt32

CertStrToNameA

rtm

RtmBlockMethods

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11e376b42ccb598b5cabc196bcf9ee23

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

crypt32

rtm

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 112KB - Virtual size: 195KB

.rsrc Size: 1024B - Virtual size: 552B

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 112KB - Virtual size: 195KB

.rsrc
Size: 1024B - Virtual size: 552B