12e157943be69775e927f22b109c6f6c

Sharing

Copy URL Twitter E-mail

General

Target

12e157943be69775e927f22b109c6f6c
Size

50KB
MD5

12e157943be69775e927f22b109c6f6c
SHA1

73cd141b512955c6edcdac997c7f95f38c27865d
SHA256

1c108d34131c523ef9eccefef65d218827d1984becc36b69fcdd8efc3e2bcafd
SHA512

bd40c5e639f37c1e14970471a52b60505b167ba3181de5500cd032ae94fcfe8c471e1a3b2f2832971e6de9b2bc66729c62d6ea25d9be391fd9b741e0f29ad0f3
SSDEEP

1536:h/6dlQZgFQYKTm5saVZR2HkChHx14AgIZ:wliQQpTMZcH1Riba

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12e157943be69775e927f22b109c6f6c

Files

12e157943be69775e927f22b109c6f6c
.exe windows:1 windows x86 arch:x86

5898d8b74a596cff3f24b0fca836a5fa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFolderPathA
ShellExecuteEx

ws2_32

htons
gethostname
gethostbyname
connect
closesocket
WSAStartup
WSACleanup
send
socket
WSAIoctl

advapi32

RegEnumKeyExA
StartServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenSCManagerA
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
DeleteService
CreateServiceA
CloseServiceHandle
AdjustTokenPrivileges

crypt32

CryptUnprotectData

gdi32

GetDeviceCaps

kernel32

Sleep
SetProcessPriorityBoost
WideCharToMultiByte
UnmapViewOfFile
lstrlenW
CloseHandle
lstrlen
lstrcpyn
lstrcpy
lstrcmpi
lstrcmp
lstrcat
SetPriorityClass
SetErrorMode
OpenProcess
MultiByteToWideChar
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateThread
CreateFileMappingA
CreateFileA
CopyFileA
WriteFile

ole32

CreateStreamOnHGlobal
CoTaskMemFree

psapi

GetModuleFileNameExA
EnumProcesses
EnumProcessModules

rasapi32

RasGetEntryPropertiesA
RasGetEntryDialParamsA
RasEnumEntriesA

shlwapi

StrChrA
PathFileExistsA
StrStrIA
StrRChrA
StrCmpNA

user32

GetDlgCtrlID
ReleaseDC
GetDC
FindWindowExA
SetActiveWindow
wsprintfA
FindWindowA
SendMessageA

wininet

InternetGetConnectedState

Sections

.text
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Windows
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5898d8b74a596cff3f24b0fca836a5fa

Headers

File Characteristics

Imports

shell32

ws2_32

advapi32

crypt32

gdi32

kernel32

ole32

psapi

rasapi32

shlwapi

user32

wininet

Sections

.text Size: 32KB - Virtual size: 36KB

.rdata Size: 3KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 192KB

.xdata Size: 4KB - Virtual size: 4KB

Windows Size: 512B - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 36KB

.rdata
Size: 3KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 192KB

.xdata
Size: 4KB - Virtual size: 4KB

Windows
Size: 512B - Virtual size: 4KB