6a3b6ddd0f81f68ff3f48c6093d366c2

Sharing

Copy URL Twitter E-mail

General

Target

6a3b6ddd0f81f68ff3f48c6093d366c2
Size

19KB
MD5

6a3b6ddd0f81f68ff3f48c6093d366c2
SHA1

ca726fc597e165e39af8f9da2400f8b5edb6bcb8
SHA256

0fcec5d2339ca8a778a2b6509b0446b5a1b00444c1063e363c5d933f232bb482
SHA512

c3f079185be57b777f506e6bafe58824f251b285b744e4a09b8db3f0ea04b04fcfe19b806ad7273e8ff43e70d68a71183baf1125cf8c6fb094c1744361178312
SSDEEP

384:s6NwlQhscp6FCpukjWdRFcSgEvjTCigmeKLO8T/jnWgw:74pcpYkjUYfEfCicAjnW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a3b6ddd0f81f68ff3f48c6093d366c2

Files

6a3b6ddd0f81f68ff3f48c6093d366c2
.exe windows:6 windows x86 arch:x86

cb1a182b51e11f1f85423474aeebcb91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreateSequential

mfc140

ord1509
ord1044
ord13688
ord316
ord4807
ord4656
ord1693
ord310
ord8426
ord321
ord2394
ord545
ord1173
ord2298
ord5679
ord11936
ord13050
ord12260
ord8718
ord1696
ord8188
ord7126
ord1692
ord12706
ord993
ord1468
ord2406
ord4806
ord1529
ord2986

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
CreateEventW
OutputDebugStringW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSectionEx
GetTempPathA
GetCommandLineA
GetModuleHandleA
CloseHandle
GetLastError
GetVolumeInformationA
WideCharToMultiByte
MultiByteToWideChar

advapi32

RegQueryValueExA
RegDeleteValueA
RegCloseKey
GetCurrentHwProfileA
RegOpenKeyExA

iphlpapi

GetAdaptersAddresses

vcruntime140

__current_exception_context
__current_exception
memset
__CxxFrameHandler3
__std_terminate
_except_handler4_common

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_set_new_mode

api-ms-win-crt-string-l1-1-0

strcat_s
strncpy_s
isspace
iscntrl

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
_close
_sopen_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_controlfp_s
terminate
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_onexit_table
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb1a182b51e11f1f85423474aeebcb91

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

mfc140

kernel32

advapi32

iphlpapi

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 908B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 908B