0c4d491453827167c6137c14e3a572af

Sharing

Copy URL Twitter E-mail

General

Target

0c4d491453827167c6137c14e3a572af
Size

16KB
MD5

0c4d491453827167c6137c14e3a572af
SHA1

f4409554195f4d4cae0e3aa876bf24fbcc280fa9
SHA256

1802438bb8b92063eb98b74ba48699c02612d563717b0a1622d2b0b529efdd8f
SHA512

e3401652f299f66d56ec61ecd21bfdecfa307db8a497bac76d9bc51784d7f588c246ccf7b44f618b5c797394ded3d48727ab1bf9b7e7d6449249830c21674e6d
SSDEEP

384:iHP0+C07Mb7Dmqs+DdyOEFHlHWzfbWEgVe1gK:iHPk07Mb7c6yOExRIf6Eg41gK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c4d491453827167c6137c14e3a572af

Files

0c4d491453827167c6137c14e3a572af
.exe windows:4 windows x86 arch:x86

edac6c7bd037bd6415a058515c1eb787

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord4079
ord2725
ord5289
ord5714
ord5302
ord4698
ord5307
ord2982
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3147
ord3259
ord3825
ord2396
ord5300
ord5199
ord4424
ord3738
ord815
ord561
ord1168
ord1146
ord2029
ord2077
ord4919
ord4975
ord4863
ord4335
ord4447
ord4411
ord2032
ord5482
ord5811
ord4779
ord3346
ord3079
ord1089
ord791
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord825
ord1247
ord540
ord3780
ord800
ord389
ord5207
ord823
ord523
ord3717
ord967
ord1995
ord5479
ord5797
ord4080
ord4622
ord3830
ord3831
ord5308
ord1576

msvcrt

__set_app_type
_except_handler3
_controlfp
_adjust_fdiv
__setusermatherr
__p__fmode
_initterm
__getmainargs
__p__acmdln
_XcptFilter
_exit
_onexit
__dllonexit
strchr
atoi
strncat
strstr
time
exit
strcat
__p__commode
_findfirst
_findnext
_findclose
memmove
strcpy
fgetc
fputc
_EH_prolog
__CxxFrameHandler
fseek
memset
strncmp
strrchr
fread
fclose
fopen
fgets
sprintf
strlen
fwrite
_setmbcp
_access

kernel32

SetCurrentDirectoryA
CreateFileA
CloseHandle
SetFileTime
GetFileTime
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
WinExec
GetProcAddress
LoadLibraryA
lstrlenA
FreeLibrary
GetCurrentProcessId
Sleep
WritePrivateProfileStringA
CopyFileA
GetVersionExA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentDirectoryA
GetModuleHandleA
GetStartupInfoA
GetModuleFileNameA
DeleteFileA
SearchPathA

user32

LoadIconA

advapi32

GetUserNameA
RegFlushKey
RegOpenKeyA
RegQueryValueExA
RegEnumKeyA
RegCloseKey
RegSetValueExA
RegCreateKeyA

shell32

ShellExecuteA

wsock32

gethostname

Sections

.text
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

edac6c7bd037bd6415a058515c1eb787

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

wsock32

Sections

.text Size: 9KB - Virtual size: 12KB

.rdata Size: 512B - Virtual size: 4KB

.data Size: 2KB - Virtual size: 56KB

.idata Size: 3KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

.text
Size: 9KB - Virtual size: 12KB

.rdata
Size: 512B - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 56KB

.idata
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB