0e15713969f7b4c9af7fae6167126d2b

Sharing

Copy URL Twitter E-mail

General

Target

0e15713969f7b4c9af7fae6167126d2b
Size

417KB
MD5

0e15713969f7b4c9af7fae6167126d2b
SHA1

a2b29e403705e9882e2561d03fe9bf9dab4cfb68
SHA256

d9cea7dfbf9ad3eff4e96ee3c11313d0fd987f4de1b616e868a01075790137f6
SHA512

bd12c5d6142cc58315b17912e3e0e9d8cd5034e1780afae519561d1404e273407bedbb46bc9d04c8e4e04d5d7b798ac56147706c60febfcdf9a5dbb7ebc89cee
SSDEEP

6144:owbtPQIm6IodI+ZtjADlVz+DE1jfEK4tgGIvnGlYJCxp8IHVNXWftTvBCH+j7ZVe:owbt4Im/ZE7DijfAj+wHPXWB7Pe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e15713969f7b4c9af7fae6167126d2b

Files

0e15713969f7b4c9af7fae6167126d2b
.exe windows:4 windows x86 arch:x86

8d86b909c2e3e13d7a1e684bf2d1a77a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
LookupPrivilegeDisplayNameA
RegQueryInfoKeyW
RegQueryValueA
CryptSetProviderA
LookupPrivilegeNameA

user32

MsgWaitForMultipleObjectsEx
OemToCharBuffA
PostThreadMessageW
GetWindowModuleFileNameW
TranslateAcceleratorW
CreatePopupMenu
GetWindowTextA
UnionRect
SetMenuDefaultItem
SetWindowLongW
GetClassLongW
UnhookWinEvent
DlgDirListComboBoxW
FindWindowExW
GetClassWord
CheckMenuItem
SetDebugErrorLevel

wininet

InternetDial
InternetGetConnectedStateEx
FtpDeleteFileA
UrlZonesDetach
FreeUrlCacheSpaceA
FindNextUrlCacheEntryExA
InternetCrackUrlW
FindFirstUrlCacheContainerA
FtpCommandW
ShowCertificate
CommitUrlCacheEntryA
InternetHangUp
SetUrlCacheEntryGroup
CreateUrlCacheContainerW
FreeUrlCacheSpaceW
InternetSetOptionA
InternetWriteFileExA
InternetConfirmZoneCrossingA

shell32

SHEmptyRecycleBinW
ExtractAssociatedIconA
ExtractIconW
ExtractAssociatedIconExA
DuplicateIcon
SHGetFileInfoW
SHAddToRecentDocs
ShellExecuteExA
ExtractAssociatedIconW
SHGetMalloc
SHBrowseForFolderA
SheChangeDirA
SHInvokePrinterCommandA
SHGetDataFromIDListW
SHGetNewLinkInfo
SheGetDirA

kernel32

VirtualQuery
TlsFree
HeapFree
DeleteCriticalSection
ReadConsoleOutputA
IsBadWritePtr
TerminateProcess
FreeEnvironmentStringsW
HeapDestroy
EnterCriticalSection
UnhandledExceptionFilter
InitializeCriticalSection
GetProfileSectionA
EnumTimeFormatsW
MultiByteToWideChar
RtlUnwind
GetProcAddress
SetFileAttributesA
VirtualFree
GetStdHandle
CreateNamedPipeA
SetHandleCount
GetEnvironmentStrings
TlsSetValue
GetCommandLineA
GetCommandLineW
SetLastError
QueryPerformanceCounter
GetCurrentProcess
GetTickCount
ExitProcess
GetFileType
HeapCreate
GetModuleHandleA
InterlockedExchange
GetNamedPipeInfo
VirtualAlloc
GetEnvironmentStringsW
HeapAlloc
FoldStringW
GetCurrentThreadId
FreeEnvironmentStringsA
GetLastError
HeapReAlloc
GetSystemTimeAsFileTime
WriteFile
GetCurrentThread
LeaveCriticalSection
GetModuleFileNameA
GetModuleFileNameW
FindAtomA
GlobalReAlloc
TlsAlloc
TlsGetValue
LoadLibraryA
GetStartupInfoW
GetCurrentProcessId
GetVersion
GetStartupInfoA
LoadResource

comdlg32

GetOpenFileNameA
GetOpenFileNameW
GetFileTitleA
FindTextW
ReplaceTextW
FindTextA

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 271KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d86b909c2e3e13d7a1e684bf2d1a77a

Headers

File Characteristics

Imports

advapi32

user32

wininet

shell32

kernel32

comdlg32

Sections

.text Size: 131KB - Virtual size: 131KB

.data Size: 271KB - Virtual size: 294KB

.rsrc Size: 13KB - Virtual size: 13KB

.text
Size: 131KB - Virtual size: 131KB

.data
Size: 271KB - Virtual size: 294KB

.rsrc
Size: 13KB - Virtual size: 13KB