748fedf9ede7f824dbdf55c56c82abbb

Sharing

Copy URL Twitter E-mail

General

Target

748fedf9ede7f824dbdf55c56c82abbb
Size

851KB
MD5

748fedf9ede7f824dbdf55c56c82abbb
SHA1

3f2f6ecf44368acf7124ae9ad25d9dd232b91d29
SHA256

52a040784addf0278aaeb6312380b3635d0ced535040e48ac1a305c069e65756
SHA512

c2621591b2e63870c69bc2469312f11ee8978baa6537ccddfa5019fbf5cb85f154e245cb64e055a37ffcade9e2c3642cd3c37ac321982b0bfec0e2b24e7af20c
SSDEEP

24576:XdOWmhFSY9CB/XD5vUqYpHK9eLjRM74OY:oWqSZB1BaK8LVoY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
748fedf9ede7f824dbdf55c56c82abbb

Files

748fedf9ede7f824dbdf55c56c82abbb
.exe windows:5 windows x86 arch:x86

c75fdaf7858208c936076eebbfb94706

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpA
CmdBatNotification
CreateTapePartition
_hread
OpenJobObjectW
CreateJobObjectA
VirtualAlloc
TzSpecificLocalTimeToSystemTime
LocalFree
Thread32Next
SetDefaultCommConfigW
SwitchToFiber
PrivCopyFileExW
HeapCompact
WaitForSingleObject
GetTempFileNameA
InitializeCriticalSection
ReadConsoleW
IsBadStringPtrW
GetCommTimeouts
LoadLibraryA
GetNumaNodeProcessorMask
GetDiskFreeSpaceW
VirtualQueryEx
FlushFileBuffers
SetProcessWorkingSetSize
GetWindowsDirectoryA
GetBinaryTypeA
PostQueuedCompletionStatus
BackupWrite
SetVolumeMountPointW
OutputDebugStringA
GetConsoleCursorInfo
GetCompressedFileSizeA
GetStringTypeA
IsValidCodePage

winsta

WinStationNameFromLogonIdA
_WinStationReInitializeSecurity
WinStationIsHelpAssistantSession
WinStationGenerateLicense
WinStationBroadcastSystemMessage
WinStationTerminateProcess
WinStationNtsdDebug
_WinStationGetApplicationInfo
WinStationConnectW
WinStationCheckLoopBack
ServerLicensingOpenW
ServerQueryInetConnectorInformationA
WinStationEnumerate_IndexedA
WinStationGetAllProcesses
_WinStationNotifyDisconnectPipe
WinStationEnumerate_IndexedW
WinStationActivateLicense
ServerLicensingFreePolicyInformation
_WinStationBeepOpen
ServerLicensingClose

inseng

CheckForVersionConflict
PurgeDownloadDirectory
GetICifFileFromFile
CheckTrustEx
CheckTrust
DownloadFile
GetICifRWFileFromFile

Sections

.text
Size: 744KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c75fdaf7858208c936076eebbfb94706

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winsta

inseng

Sections

.text Size: 744KB - Virtual size: 744KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 3KB - Virtual size: 1.4MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 744KB - Virtual size: 744KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 3KB - Virtual size: 1.4MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB