14eacf7e482073e98ebe0bd850f86e8b

Sharing

Copy URL

Twitter E-mail

General

Target

14eacf7e482073e98ebe0bd850f86e8b
Size

67KB
MD5

14eacf7e482073e98ebe0bd850f86e8b
SHA1

3168dfd3d505c83d0ba16a8a755faff49fe9f6a8
SHA256

9156708e6107f38c5a73abc571f1d2f091f7745309029fbe17a7e5a2699b1cee
SHA512

349e5edd6e75233f1b02ad16f745a049ae96c911c95c06fa1f5cf044e71e4431431ca09989a9daddd75902dd8456f05cda5a0ffdb303448b47452feb303bb104
SSDEEP

768:km5yBqbQLyM0YT6xvtqHSzadsguWB1YkYAM0yMHjfIi+Y:GBqbQ+M0FtqH0a2gxB1rb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14eacf7e482073e98ebe0bd850f86e8b

Files

14eacf7e482073e98ebe0bd850f86e8b
.exe windows:4 windows x86 arch:x86

6571097c19e38b29fdf429a299e76d74

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

WinExec
TerminateProcess
Sleep
SetFileAttributesA
ReleaseMutex
OpenProcess
LoadLibraryA
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
GetWindowsDirectoryA
GetVersionExA
GetTempPathA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetModuleHandleA
GetLastError
GetFileAttributesA
GetExitCodeThread
GetCurrentProcessId
FreeLibrary
ExitThread
DeleteFileA
DeleteCriticalSection
CreateProcessA
CreateMutexA
CopyFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle

advapi32

RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
QueryServiceStatus
OpenServiceA
OpenSCManagerA
ControlService
CloseServiceHandle

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

user32

GetKeyboardType
MessageBoxA
CharNextA
TranslateMessage
SendMessageA
PostMessageA
GetMessageA
GetForegroundWindow
FindWindowExA
FindWindowA
DispatchMessageA

wsock32

WSACleanup
WSAStartup
gethostbyname
inet_ntoa

Sections

data
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6571097c19e38b29fdf429a299e76d74

Headers

File Characteristics

Imports

kernel32

advapi32

oleaut32

urlmon

user32

wsock32

Sections

data Size: 60KB - Virtual size: 60KB

.rsrc Size: 4KB - Virtual size: 4KB

.avp Size: 2KB - Virtual size: 4KB

data
Size: 60KB - Virtual size: 60KB

.rsrc
Size: 4KB - Virtual size: 4KB

.avp
Size: 2KB - Virtual size: 4KB