0101baa05fd86f9a3c95238183f32c0e

General

Target

0101baa05fd86f9a3c95238183f32c0e
Size

172KB
MD5

0101baa05fd86f9a3c95238183f32c0e
SHA1

7066c06e0c4bbd63f7e7556e97756c93308ff94f
SHA256

e6eef394a5d4bef52b621b3fdf518c674da03c1f4e8704017e1e5840e93c65ac
SHA512

8889ee8d6eb3bb298fe748f6b9c53ca51c595a9e777ad67e9422458e8004d70dda9a1b6ac73bf2bfd45045eb301dd1f5ff814a58c23dee7c4b8a6f27f13ede3a
SSDEEP

1536:5ASh+l1y+q7HQ9Jk8fC3wcg0q2QTbFQNgWoUtMos3s4:wl0+MHQzk/3wcDq2QTB8tMoi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0101baa05fd86f9a3c95238183f32c0e

Files

0101baa05fd86f9a3c95238183f32c0e
.exe windows:4 windows x86 arch:x86

a91950bdfa45d66cc08f0a8e3df85a44

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpA
OpenProcess
GetCurrentProcess
Process32Next
Process32First
lstrcatA
SetFilePointer
FlushFileBuffers
GetOEMCP
GetACP
GetSystemWindowsDirectoryA
GetLastError
CloseHandle
CreateToolhelp32Snapshot
lstrcpyA
GetCPInfo
GetStringTypeW
GetStringTypeA
SetConsoleCtrlHandler
ExitProcess
TerminateProcess
GetCommandLineA
GetVersion
IsBadWritePtr
IsBadReadPtr
HeapValidate
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
SetStdHandle

user32

FindWindowA
ShowWindow
MessageBoxA

advapi32

AdjustTokenPrivileges
OpenProcessToken
CreateProcessAsUserA
LookupPrivilegeValueA

psapi

EnumProcessModules
GetModuleBaseNameA
EnumProcesses

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a91950bdfa45d66cc08f0a8e3df85a44

Headers

File Characteristics

Imports

kernel32

user32

advapi32

psapi

Sections

.text Size: 136KB - Virtual size: 133KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 21KB

.idata Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 136KB - Virtual size: 133KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 21KB

.idata
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 3KB