1ef49768805107adb2e12224ff0e2d09

Sharing

Copy URL Twitter E-mail

General

Target

1ef49768805107adb2e12224ff0e2d09
Size

423KB
MD5

1ef49768805107adb2e12224ff0e2d09
SHA1

a8871f0be29854e6a913ce01112c1735c0bd8bc5
SHA256

9ceebca56919ec6c9b0538960fc24b235fd0c055301426c4bfdf891a1d4cb072
SHA512

33bf5cc779125bbb6cb623d13fb0d6283ab3b62a3f629b2f0e6436947d4b3c03eb780bfd5675569468af7e38c7c5c265160acac9ebac2e8c431ec5088b8d8729
SSDEEP

12288:KWNziYgBAV/X/bDoNAJwzGMy2ka0vNXdA1606:3ziYga/vbeIwzGtvNK4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ef49768805107adb2e12224ff0e2d09

Files

1ef49768805107adb2e12224ff0e2d09
.exe windows:4 windows x86 arch:x86

d37797e7445cba70e7e4523e8bf0189e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetTextCharacterExtra
GetPixelFormat
SetTextColor
SetBkColor
DescribePixelFormat
GetMetaRgn
SelectObject
SetPolyFillMode
GetGlyphOutlineW
GetTextAlign
SetMetaFileBitsEx
GetAspectRatioFilterEx
TextOutA
GetKerningPairs
PolyPolyline
GetObjectW
StartDocW
GetROP2
RemoveFontResourceA
SetPixelV
SetStretchBltMode
CreateCompatibleDC
GetCharABCWidthsFloatW

user32

CharToOemBuffW
CallNextHookEx
GetCaretBlinkTime
DdeReconnect
GetDoubleClickTime
EnumPropsA
CreateMDIWindowW
BeginPaint
DdeNameService
EnumThreadWindows
DrawFrameControl
CheckDlgButton
FrameRect
DdeQueryConvInfo
CharUpperW

msvcrt

_lrotl
_CIcosh
_fileno
_makepath
_setmode
_safe_fprem1
__p__acmdln
_findfirst
__lc_codepage
_set_sbh_threshold
_wasctime
_findnext
_wpgmptr
memcmp
_setmaxstdio
_ismbcgraph
_statusfp
ldexp
_wfreopen
_dup2
_scalb
_wspawnlpe
vfprintf
_isctype
_ui64tow
_hypot
_wexecl
_wpopen
setbuf
wcstol
srand
getc
_mbctoupper
exit
_ismbcl0
getwchar
__STRINGTOLD

advapi32

GetFileSecurityW
StartServiceCtrlDispatcherA
SetNamedSecurityInfoExA
RegDeleteKeyA
EnumServicesStatusExA
GetFileSecurityA
LookupAccountSidW
LogonUserW
ImpersonateSelf
LsaGetRemoteUserName
CloseServiceHandle
LookupPrivilegeDisplayNameA
GetTrusteeNameA
ConvertSecurityDescriptorToAccessNamedW
GetSidIdentifierAuthority
ConvertSecurityDescriptorToAccessW

kernel32

WaitForMultipleObjectsEx
SetConsoleFont
ExitProcess
SetCriticalSectionSpinCount
CreateDirectoryA
WriteConsoleOutputAttribute
MapViewOfFile
GetModuleHandleA
GetModuleHandleW
GetConsoleCommandHistoryLengthW
GetModuleFileNameA
GetFileInformationByHandle
GetProfileSectionW
GetConsoleDisplayMode
VirtualFree
CreateWaitableTimerW
_lcreat
QueryDosDeviceW
GetLogicalDriveStringsA
OutputDebugStringW
_lclose
SetLastError
Sleep
GetTickCount
GetConsoleAliasExesA
FreeConsole
ReleaseSemaphore
WaitNamedPipeA
SizeofResource
UnhandledExceptionFilter
GetConsoleCursorInfo
AssignProcessToJobObject
GetThreadContext
GlobalSize
VirtualAlloc
FlushConsoleInputBuffer
GetStartupInfoA
SetUnhandledExceptionFilter
EnumDateFormatsExW
GetTimeFormatW
ExitThread
SetConsoleNumberOfCommandsW

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.efw
Size: 310KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crvu
Size: 104KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d37797e7445cba70e7e4523e8bf0189e

Headers

File Characteristics

Imports

gdi32

user32

msvcrt

advapi32

kernel32

Sections

.text Size: 7KB - Virtual size: 8KB

.efw Size: 310KB - Virtual size: 364KB

.crvu Size: 104KB - Virtual size: 594KB

.reloc Size: 1024B - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 8KB

.efw
Size: 310KB - Virtual size: 364KB

.crvu
Size: 104KB - Virtual size: 594KB

.reloc
Size: 1024B - Virtual size: 1KB