1a0051893e6325c27445f2822e15ee37

Sharing

Copy URL Twitter E-mail

General

Target

1a0051893e6325c27445f2822e15ee37
Size

378KB
MD5

1a0051893e6325c27445f2822e15ee37
SHA1

7e34c49e932eadfe4fc7cd42afdab9944a6af5f8
SHA256

869a9f0b2bd8d43b8d0818f4de570ce658eff3649587cdc9a0aa70ba72f204a0
SHA512

15dc3d604d23fdec419c01478b2fd6f5945c01e42ff509dfce8bd53f443eca81a561889cfa7e2a4cdcc6ec1b11760133026f2ba3ee72ddea55b55df721918ef9
SSDEEP

6144:cnHE7VLB612Ig+RjyUVRN0955D19uPNb0sBQhqt7ZCRCuIbLlgjpvTFDjSflXR2X:6wLB612uRjyUVD0xDHW50sehqk2gN7Mg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a0051893e6325c27445f2822e15ee37

Files

1a0051893e6325c27445f2822e15ee37
.exe windows:6 windows x86 arch:x86

fc329dc28ed5d2c3312fc847ce7e60f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSizeEx
CreateFileA
VerifyVersionInfoA
VerSetConditionMask
FormatMessageW
SetLastError
WaitForMultipleObjects
PeekNamedPipe
SetUnhandledExceptionFilter
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
WideCharToMultiByte
MultiByteToWideChar
Sleep
GetTickCount
QueryPerformanceCounter
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
GetLastError
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
GetConsoleWindow
GetCurrentProcessId
CloseHandle
CopyFileA
OpenProcess
VirtualAlloc
ReadFile

user32

ShowWindow

advapi32

CryptEncrypt
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
RegCreateKeyA
CryptImportKey
CryptDestroyKey
CryptDestroyHash
OpenProcessToken
RegSetValueExA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptAcquireContextA

msvcp140

?_Xlength_error@std@@YAXPBD@Z

ws2_32

WSAEventSelect
WSAWaitForMultipleEvents
closesocket
send
WSAGetLastError
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
ntohl
recv
bind
connect
getpeername
getsockname
gethostname
WSAResetEvent
sendto
getsockopt
htons
recvfrom
ntohs
freeaddrinfo
getaddrinfo
setsockopt
socket
listen
htonl
WSASetLastError
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
ioctlsocket

wldap32

ord32
ord33
ord27
ord200
ord41
ord22
ord50
ord143
ord217
ord46
ord35
ord79
ord301
ord30
ord45
ord60
ord211
ord26

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CryptDecodeObjectEx

normaliz

IdnToAscii

vcruntime140

__current_exception
__current_exception_context
_except_handler4_common
strstr
__std_exception_destroy
__std_exception_copy
memset
memcpy
strchr
memmove
strrchr
memchr
_CxxThrowException

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh
realloc
calloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fopen_s
fread
_open
_close
_write
_read
fwrite
__p__commode
_set_fmode
fclose
fputs
__stdio_common_vsscanf
_lseeki64
feof
fgets
fopen
__stdio_common_vsprintf
fputc
fflush
fseek
ftell

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_seh_filter_exe
_initialize_onexit_table
__sys_nerr
_getpid
terminate
_beginthreadex
_configure_narrow_argv
_crt_atexit
_register_thread_local_exe_atexit_callback
_controlfp_s
_c_exit
_cexit
__p___argv
__p___argc
_initialize_narrow_environment
strerror
_exit
exit
_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn
_set_app_type
_get_initial_narrow_environment
_errno

api-ms-win-crt-string-l1-1-0

strpbrk
strncpy
tolower
_strdup
strncmp
strcspn
strspn
isupper

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

wcstombs
atoi
strtoll
strtol
strtoul

api-ms-win-crt-filesystem-l1-1-0

_stat64
_access
_fstat64
_unlink

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc329dc28ed5d2c3312fc847ce7e60f5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

ws2_32

wldap32

crypt32

normaliz

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 307KB - Virtual size: 306KB

.rdata Size: 54KB - Virtual size: 54KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 307KB - Virtual size: 306KB

.rdata
Size: 54KB - Virtual size: 54KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB