061d0a1d1d2905fd95baa56ccd3478ee

Sharing

Copy URL Twitter E-mail

General

Target

061d0a1d1d2905fd95baa56ccd3478ee
Size

361KB
MD5

061d0a1d1d2905fd95baa56ccd3478ee
SHA1

50d0acd805c55b1131b02e63ee26ee6a6d571c3b
SHA256

2d534cda58aaa827c46cee89b14ce543e3741199e2594a34fb6d0fe448b54b66
SHA512

18c5c79e36dff8cef21413856eac079107dc26b08e16fc35fb6d23d18344fff54f0db53adf50e108bf34c51181f993c48f0189f8a5e6c44576c04d83a0c66948
SSDEEP

6144:/yZzlPQJQ7xONiy/dRO9msESX9iD6W+iag+dEzByd:SzNQJ8MNiy/dRO9m5SNY5BDzBy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
061d0a1d1d2905fd95baa56ccd3478ee

Files

061d0a1d1d2905fd95baa56ccd3478ee
.exe windows:5 windows x86 arch:x86

790b9332a08b7e39519ea8869dcc245d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
SetErrorMode
SetUnhandledExceptionFilter
GetFullPathNameA
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetProcAddress
GetModuleHandleA
GetProcessId
CreateMutexA
CreateRemoteThread
WaitForSingleObject
DeleteFileA
SetThreadPriority
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
InterlockedExchange
MultiByteToWideChar
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileIntA
TerminateThread
CreateIoCompletionPort
GetSystemInfo
CreateSemaphoreA
ReleaseSemaphore
ReadFile
TerminateProcess
CompareStringW
GetProcessHeap
SetEndOfFile
CreateProcessA
GetExitCodeProcess
WriteConsoleW
CreateFileW
FlushFileBuffers
LoadLibraryW
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
HeapReAlloc
GetFileAttributesA
GetTimeZoneInformation
HeapSize
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
ExitProcess
HeapCreate
IsProcessorFeaturePresent
GetFileSize
WriteFile
SetFilePointer
CreateFileA
GetLocalTime
CloseHandle
GetLastError
CreateDirectoryA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
Sleep
GetQueuedCompletionStatus
CreateThread
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
IsDebuggerPresent
UnhandledExceptionFilter
LCMapStringW
RtlUnwind
RaiseException
SetEnvironmentVariableA
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
VirtualQuery
GetModuleHandleW
VirtualAlloc
VirtualProtect
MoveFileA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
DecodePointer
EncodePointer
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte

user32

SendMessageA
GetDlgItem
SetClassLongA
EndDialog
PostQuitMessage
DefWindowProcA
DestroyWindow
BeginPaint
DialogBoxParamA
CreateDialogParamA
UpdateWindow
ShowWindow
CreateWindowExA
EndPaint
GetDC
GetClientRect
ReleaseDC
MoveWindow
SetTimer
LoadAcceleratorsA
FillRect
wsprintfA
SetWindowTextA
MessageBoxA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA

gdi32

SetTextColor
SetBkMode
CreateSolidBrush
CreateFontA
GetDeviceCaps
GetDIBColorTable
StretchBlt
CreateDIBSection
GetObjectA
CreateCompatibleDC
SetDIBColorTable
SelectObject
DeleteDC
DeleteObject
TextOutA

ole32

CreateStreamOnHGlobal

gdiplus

GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdiplusShutdown
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateFromHDC
GdipCreateFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipDeleteFont
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDrawString
GdipGetImagePixelFormat
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth

msimg32

TransparentBlt
AlphaBlend

ws2_32

WSAAccept
inet_ntoa
WSARecv
WSASend
listen
bind
htonl
WSAStartup
WSASocketA
send
recv
closesocket
WSAGetLastError
connect
gethostbyname
htons
socket

psapi

GetModuleFileNameExA
EnumProcessModules
GetModuleBaseNameA
EnumProcesses

dbghelp

MiniDumpWriteDump

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

790b9332a08b7e39519ea8869dcc245d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

gdiplus

msimg32

ws2_32

psapi

dbghelp

Sections

.text Size: 134KB - Virtual size: 133KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 24KB - Virtual size: 1.4MB

.rsrc Size: 159KB - Virtual size: 159KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 134KB - Virtual size: 133KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 24KB - Virtual size: 1.4MB

.rsrc
Size: 159KB - Virtual size: 159KB

.reloc
Size: 16KB - Virtual size: 16KB