068fe01682634d747bab12fc23d83683

Sharing

Copy URL

Twitter E-mail

General

Target

068fe01682634d747bab12fc23d83683
Size

82KB
MD5

068fe01682634d747bab12fc23d83683
SHA1

b8c40c8a81c40eef2a5ea217af174b76f4579327
SHA256

f04494bcb0d777e769134768d7b5740ca5bfd2b24c6e680bd8a2b4ff84c98271
SHA512

553fb2ed4837cfa5094815ac93bed60e7c37339e8def3cc373567c89e46761f12680532cd1a9a5dc16d2c57d5ab50a0c6aa2622b78072be2477135937cb65bf5
SSDEEP

1536:qRiIiviPM6fgPGJRXzlxM5p4oKKPZBcb+Q4LupaXhy+4UafRt3Y:qRisjqGJVfi5fPZBm+Q4LZhypp2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
068fe01682634d747bab12fc23d83683

Files

068fe01682634d747bab12fc23d83683
.exe windows:5 windows x86 arch:x86

d9b26a4b8b52dfb95f5c677f3649542c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GdiDeleteSpoolFileHandle
GetRegionData
EnumFontFamiliesExW
FloodFill
SetMiterLimit
DdEntry5
DeleteColorSpace
EngMultiByteToUnicodeN
PATHOBJ_vGetBounds
GdiCleanCacheDC
PolyBezier
DdEntry10
PolylineTo
GdiConvertAndCheckDC
XFORMOBJ_bApplyXform
GdiSetServerAttr
GetDCBrushColor
CreateBitmapIndirect
GetDeviceCaps
StartDocA
GetDCPenColor
XLATEOBJ_cGetPalette
CreateEnhMetaFileA
GdiIsMetaFileDC
GetPixel
GdiInitSpool
EngPlgBlt
GdiPlayJournal
GetPaletteEntries
GetCurrentPositionEx
GetCharABCWidthsA
GetFontAssocStatus
GetBrushOrgEx
CloseFigure
EngGetDriverName
AddFontResourceExA
EudcLoadLinkW
GdiStartPageEMF
BRUSHOBJ_pvGetRbrush
GdiPlayDCScript

ntdll

NtCreateSemaphore
RtlCompareUnicodeString
RtlLargeIntegerSubtract
ZwOpenJobObject
ZwUnloadKey
RtlpUnWaitCriticalSection
RtlExtendedIntegerMultiply
fabs
ZwSetSecurityObject
RtlUnlockBootStatusData
NtStopProfile
RtlFindMessage
RtlUnicodeStringToCountedOemString
NtRenameKey
_strcmpi
_allrem
ZwReadFileScatter
RtlLengthSid
NtOpenFile
ZwAccessCheckByTypeResultList
NtSetLowWaitHighEventPair
NtRaiseHardError
RtlpNtMakeTemporaryKey
RtlMakeSelfRelativeSD
RtlUnicodeStringToInteger
RtlUpcaseUnicodeToMultiByteN
NtAccessCheckByType
NtResetWriteWatch
RtlCopyString
ZwReleaseSemaphore
RtlFlushSecureMemoryCache
ZwImpersonateThread
RtlGetSecurityDescriptorRMControl
NtQuerySystemEnvironmentValue
RtlDllShutdownInProgress
NtCreateSymbolicLinkObject
NtOpenObjectAuditAlarm
NtSetInformationFile
ZwSetSystemInformation
RtlValidateUnicodeString
ZwAcceptConnectPort
RtlEqualUnicodeString
ZwLockProductActivationKeys
RtlAreBitsSet
ZwRequestPort
RtlDosApplyFileIsolationRedirection_Ustr
NtCreateTimer
NtDeleteBootEntry
ZwCancelTimer
ZwClearEvent
DbgUiStopDebugging
RtlGetOwnerSecurityDescriptor
RtlUnicodeToCustomCPN
ZwCancelIoFile
RtlSetInformationAcl
RtlSetOwnerSecurityDescriptor
NtOpenSemaphore
ZwCallbackReturn
RtlProtectHeap
ZwAddBootEntry

lz32

LZStart
LZClose
LZOpenFileW
LZInit
CopyLZFile
LZSeek
GetExpandedNameW
LZRead
LZDone
LZOpenFileA
LZCloseFile
LZCopy
GetExpandedNameA
LZCreateFileW

kernel32

GetVolumeInformationW
GetProfileIntA
SetDefaultCommConfigA
GetProfileSectionW
IsValidCodePage
VirtualUnlock
EnterCriticalSection
SetLocaleInfoW
ChangeTimerQueueTimer
IsDebuggerPresent
GlobalFree
GetSystemDefaultLCID
GetConsoleMode
VirtualAlloc
ReleaseSemaphore
IsValidLocale
_lopen
CreateMailslotW
GetOEMCP
LoadLibraryA
GetCPInfoExW
GetUserDefaultLCID
SetMailslotInfo
WaitNamedPipeW
OpenThread
SetTermsrvAppInstallMode
SetLastConsoleEventActive
GetOverlappedResult
ReadConsoleInputExW
ConvertDefaultLocale
DeleteFileW
GetConsoleKeyboardLayoutNameA
GetConsoleCommandHistoryLengthA
GetCalendarInfoW
SetConsoleInputExeNameA
FileTimeToDosDateTime
LeaveCriticalSection

msvcrt

exit
__getmainargs
__p__commode
__set_app_type

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9b26a4b8b52dfb95f5c677f3649542c

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

ntdll

lz32

kernel32

msvcrt

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 23KB - Virtual size: 188KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 23KB - Virtual size: 188KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 1024B