1454d4feacdd503c0542f70f44a8edc1

Sharing

Copy URL

Twitter E-mail

General

Target

1454d4feacdd503c0542f70f44a8edc1
Size

1.7MB
MD5

1454d4feacdd503c0542f70f44a8edc1
SHA1

8b9d82882288adc86f58154ed5b2ceb5b626ce66
SHA256

179d18ad80b718d861ea0b4b06ad885e0a7760051497db6eb87315f92dd24b53
SHA512

fb3f89efbbb178842809244f24d73aba338f4b5ee407a02f89d04c45baf25211352870d75b6b35e8ffd34614bfb0c527cbecb3f428c33dd70d40ee577475eb38
SSDEEP

24576:+YSOaapO+S5on5eAqF+yVFuhVTOZDY+HwQemjgY/QoP1VnKfJiIHvBN6HJp:67awEior92HQoP1VnKjHvBN6HJp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1454d4feacdd503c0542f70f44a8edc1

Files

1454d4feacdd503c0542f70f44a8edc1
.exe windows:5 windows x86 arch:x86

53078a22248eef16f5e5a62910f2862b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
ioctlsocket
gethostname
WSACleanup
WSASetLastError
WSAIoctl
gethostbyname
shutdown
send
connect
recv
htons
WSAGetLastError
closesocket
select
socket
setsockopt

shlwapi

PathFileExistsA

user32

CloseDesktop
wsprintfA
GetProcessWindowStation
GetUserObjectInformationW
TranslateMessage
DispatchMessageA
GetUserObjectInformationA
SetThreadDesktop
GetThreadDesktop
OpenInputDesktop
GetMessageA
MessageBoxW

advapi32

CryptDestroyKey
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegCloseKey
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
RegEnumKeyExA
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource

kernel32

LCMapStringW
CompareStringW
HeapAlloc
HeapFree
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
CreateFileW
SetConsoleCtrlHandler
GetACP
GetModuleFileNameW
ExitProcess
GetStringTypeW
FindFirstFileExW
IsValidCodePage
GetOEMCP
FreeLibraryAndExitThread
ExitThread
LoadLibraryW
GetProcAddress
ReadFile
EnterCriticalSection
WriteFile
LeaveCriticalSection
CreatePipe
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
SetEvent
CloseHandle
CreateThread
ResetEvent
DeleteCriticalSection
CreateEventA
Sleep
GetTickCount
VirtualFree
VirtualAlloc
CancelIo
FindFirstFileA
GetDriveTypeA
FindNextFileA
SetFilePointer
FindClose
LocalAlloc
GetCPInfo
DeleteFileA
GetLogicalDriveStringsA
LocalFree
GetFileSize
GetLocalTime
GetCurrentProcessId
InterlockedDecrement
InterlockedExchangeAdd
WideCharToMultiByte
InterlockedIncrement
InterlockedExchange
OpenEventA
SetErrorMode
LoadLibraryA
GetVersionExA
DisconnectNamedPipe
GetSystemDirectoryA
OutputDebugStringW
SetUnhandledExceptionFilter
GetCurrentProcess
MultiByteToWideChar
GetLastError
DecodePointer
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleExW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
DeleteFiber
ConvertFiberToThread
FreeLibrary
FindFirstFileW
FindNextFileW
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
SystemTimeToFileTime
LoadLibraryExW
RtlUnwind
RaiseException
EncodePointer
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
HeapReAlloc
FlushFileBuffers
GetConsoleCP
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetModuleHandleA

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53078a22248eef16f5e5a62910f2862b

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

shlwapi

user32

advapi32

kernel32

crypt32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 436KB - Virtual size: 436KB

.data Size: 23KB - Virtual size: 43KB

.gfids Size: 512B - Virtual size: 340B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 57KB - Virtual size: 57KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 436KB - Virtual size: 436KB

.data
Size: 23KB - Virtual size: 43KB

.gfids
Size: 512B - Virtual size: 340B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 57KB - Virtual size: 57KB