13edbc7952878c8de92a3f72c86ec367

Sharing

Copy URL Twitter E-mail

General

Target

13edbc7952878c8de92a3f72c86ec367
Size

556KB
MD5

13edbc7952878c8de92a3f72c86ec367
SHA1

cc6755b61b79f1964602f8aac0ac38f84887aed8
SHA256

9b465a3d9be972f8fd5473dd09af01a4f3ef3218b422191ad5d81e40e2779fe8
SHA512

25821e6181128f221512be9464feb65048a0217de159a8dac507a1f6f2b21db1987631ccd04f63e1bac1cbede9d44adbb601a65ee3759e6ef1ee5f1459187f07
SSDEEP

6144:2y0CPLSGTHZhUb3je/k+2ngM0vsGVkJSabajwmwf0QIr:2y0eHk4k+2nBtGVkJSCajbr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13edbc7952878c8de92a3f72c86ec367

Files

13edbc7952878c8de92a3f72c86ec367
.exe windows:4 windows x86 arch:x86

e216adb3f6f707bc5500399af0367d6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoW
SetEndOfFile
GetACP
IsBadCodePtr
CopyFileA
ExitProcess
CreateThread
TerminateThread
GetFileSize
SetFilePointer
ReadFile
CreateFileA
GetModuleFileNameA
lstrlenA
Sleep
ExitThread
GetLocalTime
GetSystemDirectoryA
WriteFile
GetOEMCP
CloseHandle
SetStdHandle
GetStringTypeW
GetStringTypeA
SetConsoleCtrlHandler
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlushFileBuffers
WideCharToMultiByte
MultiByteToWideChar
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetTimeZoneInformation
GetSystemTime
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetEnvironmentVariableA

user32

GetKeyState
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState

gdi32

DeleteObject
CreateDCA
GetDeviceCaps
CreateCompatibleDC
DeleteDC
CreateDIBSection
SelectObject
BitBlt
GetDIBColorTable

advapi32

RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA

ws2_32

listen
select
accept
inet_ntoa
recv
socket
ntohs
inet_addr
gethostbyname
connect
closesocket
getsockname
send
bind
htonl
WSACleanup
WSAStartup
htons

Sections

.text
Size: 468KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e216adb3f6f707bc5500399af0367d6c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

Sections

.text Size: 468KB - Virtual size: 465KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 20KB - Virtual size: 29KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 20KB - Virtual size: 16KB

.text
Size: 468KB - Virtual size: 465KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 20KB - Virtual size: 29KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 20KB - Virtual size: 16KB