119e6e38cf768abc6186018c0281667f

Sharing

Copy URL Twitter E-mail

General

Target

119e6e38cf768abc6186018c0281667f
Size

115KB
MD5

119e6e38cf768abc6186018c0281667f
SHA1

0a02c5ca41f3c5ea736574a02b098a3476e3e83d
SHA256

c3f554529e1bbcd35b6e39ceb6b6e0aa135e0608b6af9296d2d91a6dd068c6c5
SHA512

2db0043db2c3ee166f027419ed64015c651a269f01f55f1d37466d9d65a3173ad3b0fcc531426f0173a406c253fb9bf781538bb67f4d150c6488983faf26a3e2
SSDEEP

3072:YmpEp9xUWu1gGjXr2vwvEbMps2i/XHCo3:YmpPTj7QIpsP1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
119e6e38cf768abc6186018c0281667f

Files

119e6e38cf768abc6186018c0281667f
.exe windows:4 windows x86 arch:x86

34189d522d9c31eeba7932abd1253947

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comdlg32

GetFileTitleA
GetSaveFileNameA

version

GetFileVersionInfoSizeA
VerFindFileA

kernel32

GetStringTypeW
ExitThread
SetEvent
GetModuleFileNameA
GetProcAddress
GetStdHandle
lstrcpyA
GlobalDeleteAtom
GetCurrentThreadId
VirtualAllocEx
SizeofResource
DeleteCriticalSection
GetModuleHandleA
GetUserDefaultLCID

comctl32

ImageList_Write
ImageList_DrawEx
ImageList_Remove
ImageList_Add
ImageList_GetBkColor
ImageList_DragShowNolock
ImageList_Destroy
ImageList_Read
ImageList_Draw

ole32

CoRevokeClassObject
CoGetMalloc
CoUnmarshalInterface
CreateOleAdviseHolder

gdi32

LineTo
SetBkColor
GetDIBColorTable
CreateBitmap
GetDIBits
CopyEnhMetaFileA
CreatePenIndirect
GetPixel
CreatePalette
GetPaletteEntries

advapi32

RegQueryInfoKeyA
RegLoadKeyA
RegQueryValueExA

user32

DrawIconEx
SetScrollRange
SetCapture
EndPaint
ClientToScreen
EnableWindow
GetWindowPlacement
AdjustWindowRectEx
PostQuitMessage
KillTimer
DestroyWindow
OffsetRect
GetMessagePos
GetKeyboardLayoutList
GetTopWindow
EnumThreadWindows
GetSubMenu
DispatchMessageW
GetKeyboardState
SetPropA
CloseClipboard
RemovePropA
LoadCursorA
MapVirtualKeyA
MsgWaitForMultipleObjects
GetCursor
LoadIconA

oleaut32

SafeArrayCreate
SysStringLen
SafeArrayPtrOfIndex
VariantCopyInd
VariantChangeType
SysFreeString
SafeArrayGetElement
SafeArrayGetUBound
SysAllocStringLen
RegisterTypeLib

shell32

SHGetFolderPathA
SHGetDesktopFolder
SHGetFileInfoA
SHGetSpecialFolderLocation
SHFileOperationA

shlwapi

PathIsContentTypeA
SHGetValueA
SHQueryValueExA

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34189d522d9c31eeba7932abd1253947

Headers

File Characteristics

Imports

comdlg32

version

kernel32

comctl32

ole32

gdi32

advapi32

user32

oleaut32

shell32

shlwapi

Sections

.text Size: 28KB - Virtual size: 27KB

.edata Size: 512B - Virtual size: 500B

BSS Size: 82KB - Virtual size: 81KB

DATA Size: 1KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.edata
Size: 512B - Virtual size: 500B

BSS
Size: 82KB - Virtual size: 81KB

DATA
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB