08f9a1ca9a3a2037a49f4d815a694f18

Sharing

Copy URL Twitter E-mail

General

Target

08f9a1ca9a3a2037a49f4d815a694f18
Size

2.0MB
MD5

08f9a1ca9a3a2037a49f4d815a694f18
SHA1

c35b383bf2cfcea2e62ddfe50e285f6c410bfdaa
SHA256

246470ddf474b16e91984598073126bee9b533e9bc8eef56373817ab3e255c93
SHA512

4eda9a774918901338d5d0e464807c16217acf13d17c1bf799a17b83047f68105de0efb8e3f39c77d5203cfa60576a7de13a551e3f607669581687628d1faa7e
SSDEEP

49152:1ZpOZsg6Negbkv+pIcbNO2YukJz9HEmGN92ye:1Z86gv+plNBYdp1O92p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08f9a1ca9a3a2037a49f4d815a694f18

Files

08f9a1ca9a3a2037a49f4d815a694f18
.exe windows:4 windows x86 arch:x86

c4cf5c14f0cbd24694295d32df112141

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathStripToRootW
PathFileExistsW
PathFindExtensionW

msvcrt

_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
_exit

advapi32

ReportEventW
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
CheckTokenMembership
RegDeleteValueA
RegDeleteValueW
RegCloseKey
InitializeSecurityDescriptor
IsValidSecurityDescriptor
RegOpenKeyExW
RegQueryValueW
RegSetValueExA
EqualSid
RegSetValueExW
FreeSid
OpenProcessToken
LsaClose

gdi32

GetDeviceCaps
CreateFontIndirectW
SetTextColor
SetROP2
CreateBrushIndirect
GetPixel
EnumFontFamiliesExW
GetTextExtentPoint32W
DeleteDC
CreateCompatibleDC
LineTo
DPtoLP
GetTextMetricsW
SetBkColor
SelectObject
SetPixelFormat
DeleteObject

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_Destroy

shell32

SHGetMalloc
ShellExecuteExW
DragFinish
ShellExecuteExA
Shell_NotifyIconW
SHGetPathFromIDListW
SHFileOperationA
SHGetFileInfoW
SHFileOperationW
CommandLineToArgvW
ShellExecuteW
SHGetSpecialFolderLocation

kernel32

FreeLibrary
VirtualFree
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
QueryPerformanceCounter
UnhandledExceptionFilter
GetLocalTime
TerminateProcess
CloseHandle
InterlockedExchange
GetLastError
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
SetUnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoA

ole32

OleIsCurrentClipboard
OleInitialize
CoTaskMemFree
StgCreateDocfileOnILockBytes
CoUninitialize
OleUninitialize
CoCreateInstance

comdlg32

ChooseColorW
FindTextW
GetOpenFileNameW
CommDlgExtendedError

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4cf5c14f0cbd24694295d32df112141

Headers

File Characteristics

Imports

shlwapi

msvcrt

advapi32

gdi32

comctl32

shell32

kernel32

ole32

comdlg32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 132KB - Virtual size: 128KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 132KB - Virtual size: 128KB

.rsrc
Size: 20KB - Virtual size: 16KB