6d5c1549eb525feac50c744eddad0c77

Sharing

Copy URL

Twitter E-mail

General

Target

6d5c1549eb525feac50c744eddad0c77
Size

278KB
MD5

6d5c1549eb525feac50c744eddad0c77
SHA1

15368cc4d9ba597823fc89b184f6d2187d7f27bf
SHA256

07a375f23402e78c700534de799f821befe5b710cb36cb6034ad3d39ea79164b
SHA512

1d4f7e897626735c20c3983b215566ddccdc11673443038589feb60727202caee12154e873e48595e523ac0c2f4bb12dae7fda39cc4aa5e97c18d3333350b2c4
SSDEEP

6144:HMNohmsvZ6ilPEoq2gVJLiT5xhNj0DdcN84iYbb9SqcAQMEBJdCmraJ2:HMNo4sv8UNQNiT5xP6uiIkPBrCmb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d5c1549eb525feac50c744eddad0c77

Files

6d5c1549eb525feac50c744eddad0c77
.exe windows:4 windows x86 arch:x86

ad954c607416ec333a937f892e0f0a0c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
_CIsinh
malloc
free
fseek
ftell
fread
fclose
atof
atoi
sscanf
strlen
sprintf
strcpy
_strdup
realloc
strncmp
strspn
strncpy
strtoul
isdigit
strncat
fflush
__p__iob
exit
getenv
fopen
fgets
isspace
strchr
isalpha
feof
time
fwrite
memmove
_errno
isalnum
strstr
isupper
tolower
islower
toupper
strtol
_unlink
strerror
_stat
_rmdir
isxdigit

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
GetExitCodeProcess
FreeLibrary
HeapFree
LoadLibraryA
GetProcAddress
HeapAlloc
EnterCriticalSection
HeapReAlloc
LeaveCriticalSection
TlsGetValue
TlsSetValue
TlsAlloc
InterlockedExchange
LoadLibraryExA
FormatMessageA
GetCurrentThreadId
MoveFileExA
GetLastError
CreateDirectoryA
CreateFileA
MultiByteToWideChar
DeviceIoControl
LocalFree
RemoveDirectoryA
GetFileAttributesExA
SleepEx
GetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
WaitForMultipleObjects
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
CreateThread
ReleaseSemaphore

advapi32

GetUserNameA

secur32

FreeCredentialsHandle
DeleteSecurityContext
InitializeSecurityContextA
FreeContextBuffer
AcquireCredentialsHandleA

wsock32

WSAStartup
WSACleanup
setsockopt
WSAGetLastError
closesocket
socket
connect
htonl
send
WSASetLastError
recv
getsockopt
getsockname
ntohl
ntohs
select
htons
ioctlsocket
inet_ntoa
gethostbyname

shfolder

SHGetFolderPathA

Sections

.code
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad954c607416ec333a937f892e0f0a0c

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

secur32

wsock32

shfolder

Sections

.code Size: 9KB - Virtual size: 9KB

.text Size: 67KB - Virtual size: 66KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 6KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 4KB

.code
Size: 9KB - Virtual size: 9KB

.text
Size: 67KB - Virtual size: 66KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 4KB