0623e06ab9a26766d3640937dafd3e43

Sharing

Copy URL Twitter E-mail

General

Target

0623e06ab9a26766d3640937dafd3e43
Size

69KB
MD5

0623e06ab9a26766d3640937dafd3e43
SHA1

e1f6c565da24787aca6a25d0fcdadd900a7a18f7
SHA256

a9f64dd32baa1977d9a0541a50131eef3a78f488905b819a8910b9e539533b8f
SHA512

083b2afdaac80d7a0a95e618b4ff587e230eddf780f6a1f6526fb653f6e95f33b206d5acd2e0baf7199f0f5643a44d50c5be61baec6f327875dbf99dbe864021
SSDEEP

1536:4Z7d289v8jKA2fcNrWhHVE9bg78hAnS8p8U8QZJ6jaEF:4rh3F+WhHjnS8p8U8QZJ6j1F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0623e06ab9a26766d3640937dafd3e43

Files

0623e06ab9a26766d3640937dafd3e43
.exe windows:1 windows x86 arch:x86

294389dc34c1d08e6b113bd73542bf8b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetFileSize
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetTempPathA
CopyFileA
LoadLibraryA
MapViewOfFile
Module32First
OpenProcess
OpenThread
Process32First
Process32Next
CreateFileA
CreateFileMappingA
ResumeThread
RtlUnwind
Sleep
Thread32First
Thread32Next
UnmapViewOfFile
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
CreateRemoteThread
WriteProcessMemory
CreateThread
CreateToolhelp32Snapshot
DeleteFileA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ChangeServiceConfigA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
StartServiceCtrlDispatcherA
CreateServiceA

crtdll

__GetMainArgs
_stricmp
_strnicmp
exit
fclose
fopen
fread
free
fseek
fwrite
malloc
memcpy
memset
printf
raise
rand
signal
sprintf
srand
strcat
strcmp
strncpy
strrchr
time

Exports

Exports

_ServiceHandler@4
_ServiceMain@8
_makedll@4
_workthread@0

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 804B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 160B - Virtual size: 160B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

294389dc34c1d08e6b113bd73542bf8b

Headers

File Characteristics

Imports

version

kernel32

advapi32

crtdll

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.bss Size: - Virtual size: 804B

.data Size: 54KB - Virtual size: 54KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.edata Size: 160B - Virtual size: 160B

.text
Size: 8KB - Virtual size: 8KB

.bss
Size: - Virtual size: 804B

.data
Size: 54KB - Virtual size: 54KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.edata
Size: 160B - Virtual size: 160B