041feb2bd5f8b68a529b993dc307eefa

Sharing

Copy URL Twitter E-mail

General

Target

041feb2bd5f8b68a529b993dc307eefa
Size

3.8MB
MD5

041feb2bd5f8b68a529b993dc307eefa
SHA1

f1c4b2a51231e77eef271528332f0dd31549c549
SHA256

c0ebc8a4d9de2e916efe7a76d82c766a1dba1851d61d5feb49b30c0042c14845
SHA512

40fcd157b70d621988b5fc771c396e5eb0f6bfa3ba5d87919ad266e32f9f0aca8066c04890a3b59ab16e0e21d293267f21fb9f24d9ae29783c1d66a6f002194e
SSDEEP

98304:0oL83YNtrWDpa+hwGDPWjMJ+CSRpsTV3ryRVWPkoV1QeKQCGpK6nl:0DEW9TwGD+4J+CSRpsTV3mW5V1Q7QCGT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
041feb2bd5f8b68a529b993dc307eefa

Files

041feb2bd5f8b68a529b993dc307eefa
.exe windows:5 windows x64 arch:x64

0b0dcf92eaf51231ad96cebe153bc715

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

WSACleanup

winmm

mixerSetControlDetails

version

VerQueryValueW

comctl32

ImageList_Create

psapi

GetModuleFileNameExW

kernel32

GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

RedrawWindow
CharUpperBuffW

gdi32

GetPixel

comdlg32

CommDlgExtendedError

advapi32

RegDeleteKeyW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

DragQueryPoint

ole32

OleInitialize

oleaut32

SafeArrayGetLBound

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 778KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b0dcf92eaf51231ad96cebe153bc715

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

winmm

version

comctl32

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

wtsapi32

Sections

.text Size: - Virtual size: 778KB

.rdata Size: - Virtual size: 226KB

.data Size: - Virtual size: 47KB

.pdata Size: - Virtual size: 27KB

.gfids Size: - Virtual size: 236B

.tls Size: 512B - Virtual size: 9B

.vmp0 Size: - Virtual size: 3.2MB

.vmp1 Size: 3.6MB - Virtual size: 3.6MB

.reloc Size: 512B - Virtual size: 40B

.rsrc Size: 220KB - Virtual size: 219KB

.text
Size: - Virtual size: 778KB

.rdata
Size: - Virtual size: 226KB

.data
Size: - Virtual size: 47KB

.pdata
Size: - Virtual size: 27KB

.gfids
Size: - Virtual size: 236B

.tls
Size: 512B - Virtual size: 9B

.vmp0
Size: - Virtual size: 3.2MB

.vmp1
Size: 3.6MB - Virtual size: 3.6MB

.reloc
Size: 512B - Virtual size: 40B

.rsrc
Size: 220KB - Virtual size: 219KB