00644af49638d1e792ef331b44411fec

Sharing

Copy URL Twitter E-mail

General

Target

00644af49638d1e792ef331b44411fec
Size

732KB
MD5

00644af49638d1e792ef331b44411fec
SHA1

6bada9213784f5b8ccf70cd790712939814d3ef6
SHA256

e276c2b244150471a2827603f7129cc6b71b966fe8c3cda9cab9c7bef2ea7804
SHA512

1d6e332214a16ab4f5cef324d27726c70c36ce4b746c4866a9d02d70a1b9379b64dba63127fd128e46c312272670bc17fe961d963a3422c0fc3d3a5bdb9a2851
SSDEEP

12288:Od3FDDZt7NLOYIASL8vypFd1ebMvUUKo1nWjhStiSbUccD7IwsrcmR:iFD/EYIASL8CIiUUKtYcwUcc5q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00644af49638d1e792ef331b44411fec

Files

00644af49638d1e792ef331b44411fec
.exe windows:4 windows x86 arch:x86

0a90de418f39ddb3ac8b9a4b5ec82b88

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
FindNextFileA
LoadLibraryA
WriteFile
CreateFileA
GetProcAddress
CloseHandle
GetCurrentProcess
FreeLibrary
GetSystemTime
lstrcpyA
GetEnvironmentVariableA
lstrlenA
GetShortPathNameA
lstrcatA
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
VirtualAlloc
VirtualProtect
lstrcmpA
GetModuleHandleA
ExitProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32Next
Module32First
CreateMutexA
Sleep
GetLastError
GetComputerNameA
GetModuleFileNameA
GetTempPathA
HeapAlloc
CopyFileA
SetEndOfFile
CreateFileW
GetLocaleInfoW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetUserDefaultLCID
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetModuleFileNameW
HeapValidate
DeleteFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
GetStartupInfoA
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetCPInfo
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
GetConsoleCP
GetConsoleMode
ReadFile
FlushFileBuffers
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
HeapReAlloc
HeapDestroy
HeapCreate
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA

advapi32

RegQueryValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegCloseKey
GetUserNameA

shell32

SHGetFolderPathA

shlwapi

PathRemoveArgsA
PathUnquoteSpacesA

wininet

InternetOpenA
FtpPutFileA
InternetCloseHandle
FtpSetCurrentDirectoryA
InternetConnectA

Sections

.text
Size: 288KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 316KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a90de418f39ddb3ac8b9a4b5ec82b88

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

wininet

Sections

.text Size: 288KB - Virtual size: 284KB

.rdata Size: 104KB - Virtual size: 100KB

.data Size: 316KB - Virtual size: 344KB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 288KB - Virtual size: 284KB

.rdata
Size: 104KB - Virtual size: 100KB

.data
Size: 316KB - Virtual size: 344KB

.rsrc
Size: 20KB - Virtual size: 19KB