148b3c87818c9060c0e50f608612f879

Sharing

Copy URL Twitter E-mail

General

Target

148b3c87818c9060c0e50f608612f879
Size

242KB
MD5

148b3c87818c9060c0e50f608612f879
SHA1

88fe2749d6ec606004f42e5a569b8a6aea28064a
SHA256

8ae2d17ec075b1477573571d24bf3540ca59ad8d7a9f6f20edfd5e26df77415c
SHA512

7696e4463b3d48d0681f4afcec973a996e051749976cf0e6886c333b033f875b453049fd2f5168f3d97b6228d40ea24a0ce31e0bd6e023ffd532bc7fe3b17c80
SSDEEP

6144:B16JwvozYUf80xJRyedbiVUdmKvumaRN0zKLM3bskSx+BmV5f9+:mJOozI0xOed+2mJRNhY3bP9B25f9+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
148b3c87818c9060c0e50f608612f879

Files

148b3c87818c9060c0e50f608612f879
.exe windows:4 windows x86 arch:x86

9dc83d04a9ce96d3de400a4ebc28b4de

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
TlsSetValue
WriteProfileStringA
OpenEventA
MultiByteToWideChar
DeleteCriticalSection
HeapAlloc
LoadLibraryA
GetCommandLineA
HeapCreate
WriteConsoleOutputCharacterW
GetStringTypeExA
GlobalCompact
GetFileType
InterlockedExchange
GetTickCount
GetEnvironmentStrings
TlsAlloc
TlsFree
GetProcessHeap
GetVersion
GetStartupInfoW
TlsGetValue
GetStdHandle
FlushFileBuffers
WriteFile
IsBadWritePtr
SetLastError
GetProcAddress
FreeEnvironmentStringsA
SetHandleCount
HeapFree
MapViewOfFile
GetStartupInfoA
FindClose
GetModuleFileNameW
VirtualQuery
GetCommandLineW
InitializeCriticalSection
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetCurrentProcessId
FreeEnvironmentStringsW
LeaveCriticalSection
HeapReAlloc
VirtualFree
ExitProcess
EnterCriticalSection
GetPrivateProfileSectionNamesA
VirtualAlloc
TerminateProcess
QueryPerformanceCounter
GetCurrentProcess
GetLastError
GetModuleHandleA
HeapDestroy
GetModuleFileNameA
OpenMutexA
GetCurrentThreadId
RtlUnwind
UnhandledExceptionFilter

user32

DispatchMessageA
SetScrollPos
DrawFrame
ClipCursor
CreatePopupMenu

shell32

ShellHookProc
FindExecutableW
DuplicateIcon
SHAppBarMessage
SHGetDiskFreeSpaceA
SHGetDesktopFolder
SHBrowseForFolderA
SHGetDataFromIDListW
SHFormatDrive
RealShellExecuteA
DragQueryPoint
SHGetInstanceExplorer
ShellExecuteEx
SheSetCurDrive
SHBrowseForFolderW

wininet

FtpFindFirstFileA
SetUrlCacheEntryGroupW
DeleteUrlCacheContainerA
InternetCombineUrlW
InternetGetCookieW
FtpCommandW
DeleteUrlCacheGroup
InternetDialW
InternetSecurityProtocolToStringW
InternetReadFileExA
InternetSetOptionA
InternetGetConnectedStateExW
RetrieveUrlCacheEntryStreamA
CreateUrlCacheEntryW
InternetCrackUrlA
FtpPutFileW
GetUrlCacheConfigInfoW
SetUrlCacheConfigInfoW
SetUrlCacheEntryGroupA
UrlZonesDetach
HttpCheckDavCompliance

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 130KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dc83d04a9ce96d3de400a4ebc28b4de

Headers

File Characteristics

Imports

kernel32

user32

shell32

wininet

Sections

.text Size: 101KB - Virtual size: 101KB

.data Size: 130KB - Virtual size: 142KB

.rsrc Size: 10KB - Virtual size: 9KB

.text
Size: 101KB - Virtual size: 101KB

.data
Size: 130KB - Virtual size: 142KB

.rsrc
Size: 10KB - Virtual size: 9KB