12e967bb40e1280351e8f222372303d9

General

Target

12e967bb40e1280351e8f222372303d9
Size

220KB
MD5

12e967bb40e1280351e8f222372303d9
SHA1

b22a9be934711ea3c2d266f311aa8adaab53995c
SHA256

da80ab980e6deab3a72681b50c32bcfc58f6725c651e841cbff05e9d679677c3
SHA512

d1591b92a74b2dd2503b24fb5e049b29d6f6b42375e37aac1cf1d34bb5123b49d1d0a0e925472880d4a5b3566e960f91cff641bdf3cd0c9ac8f1a80b4374cd80
SSDEEP

3072:9pX8a7mfc1xwkWvnw2ZMRaCRs0l84O7LbCdjQNI/3lbtdK8Bve794oidI5s4:nxS/kW/lWRH04bjQO3l3Ke64De5s4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12e967bb40e1280351e8f222372303d9

Files

12e967bb40e1280351e8f222372303d9
.exe windows:4 windows x86 arch:x86

01492257d713998956d19cbd5e688028

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
VirtualAlloc
LocalLock
GetEnvironmentStrings
FlushFileBuffers
GetExitCodeProcess
HeapUnlock
VirtualProtect
LoadLibraryA
GlobalLock
GetProcAddress
WaitForSingleObject
GetModuleHandleA
CreateTimerQueue
GetCurrentProcess
CreateEventA
ResetEvent
VirtualFree
VirtualLock
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
VirtualQuery
InterlockedExchange
RtlUnwind
HeapCompact
OpenMutexA
HeapReAlloc
HeapAlloc
GetCPInfo
GetOEMCP
GetSystemInfo
GetACP
HeapFree
HeapCreate
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
TerminateProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy

user32

GetDesktopWindow
IsIconic
LoadCursorA
GetCursorPos
SetTimer
ReleaseDC
CreateIcon
SetCursorPos
UpdateWindow
GetWindowRect
SetCursor
IsChild
LoadIconA
GetDC

gdi32

FloodFill

psapi

GetProcessMemoryInfo
EnumProcessModules
EmptyWorkingSet

msvfw32

DrawDibSetPalette
DrawDibDraw
ICCompressorFree
DrawDibEnd

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01492257d713998956d19cbd5e688028

Headers

File Characteristics

Imports

kernel32

user32

gdi32

psapi

msvfw32

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 128KB - Virtual size: 124KB

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 128KB - Virtual size: 124KB