0cc76feffaa79b8c816058d5399446bb

Sharing

Copy URL Twitter E-mail

General

Target

0cc76feffaa79b8c816058d5399446bb
Size

204KB
MD5

0cc76feffaa79b8c816058d5399446bb
SHA1

ed313b9e0ae5f1528374633cfc3ce33788e8fcca
SHA256

9d5ef4571f4e8abc99a667cdf3e2dab9cde491ccff700d67b16caba036bcbca6
SHA512

f4ef4d5a36ed7f34c226760e4fed9a6e8840a58072ea3bd4d573bd1b0be7f3b38f24cf599233facbb0666b53575fa629b8a3c2d77b0f614416ea0bd31df46b3f
SSDEEP

3072:lMdT6B1nK4lGg4ra+x/UjB1fZ1w5NaE/qvkuQKRgA8gwA4k5eh7NcntOovWFZWMn:u6B1KH/rPcPw51qzQ9MGkG44a8sMn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cc76feffaa79b8c816058d5399446bb

Files

0cc76feffaa79b8c816058d5399446bb
.exe windows:4 windows x86 arch:x86

ce093e04fbfe5a1f9f937a1abc344550

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrIA
StrChrA
StrRChrA

kernel32

GetTempPathA
GetWindowsDirectoryA
GetTickCount
FreeResource
WriteFile
SizeofResource
LoadResource
FindResourceA
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
CloseHandle
GetModuleHandleA
Sleep
GetLastError
GetVersionExA
LocalFree
GetCurrentProcess
WaitForSingleObject
lstrcpyA
lstrcpynA
SetFilePointer
GetFileSize
ReadFile
GetModuleFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
MoveFileA
MoveFileExA
GetTempFileNameA
SetFileAttributesA
GetVolumeInformationA
CreateProcessA
CreateMutexA
SetEvent
CreateEventA
FlushFileBuffers
GetStringTypeA
GetSystemInfo
FindFirstFileA
lstrcmpA
FindNextFileA
GetFileAttributesA
CreateFileA
lstrlenA
lstrcatA
GetStringTypeW
SetStdHandle
VirtualProtect
GetLocaleInfoA
ExitProcess
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
HeapAlloc
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
HeapFree
SetUnhandledExceptionFilter
HeapReAlloc
TerminateProcess
HeapSize
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr

user32

wsprintfA

advapi32

RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
SetEntriesInAclA
SetSecurityInfo
RegFlushKey
RegCloseKey
RegDeleteKeyA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce093e04fbfe5a1f9f937a1abc344550

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 156KB - Virtual size: 154KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 156KB - Virtual size: 154KB