1a401efafbc3c5d4d5bcec53a62a0e60

General

Target

1a401efafbc3c5d4d5bcec53a62a0e60
Size

174KB
MD5

1a401efafbc3c5d4d5bcec53a62a0e60
SHA1

5b201a2cd6fe9866db088e428b1a7e69c184cdef
SHA256

6aca115059835c4f00e3172d04a757239c86f624d4e0bd623401a034cff5023e
SHA512

abeb548028adb71d03fe73093768b972b41c6ddbd9f7021150ef77a1c792705fedb776b94afa7bc6b3668b65e19d871e3bde51a6441041dd79868a70249e3dd0
SSDEEP

3072:gzPNvrNePRoY64BhM51Cc0BgDPqzx7OmQC0XrdngigAHTSj5Q+vmF9Q5KR8e8Nkc:cPNHYRM51Ccih+C05ngAzSlQL8Hec

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a401efafbc3c5d4d5bcec53a62a0e60

Files

1a401efafbc3c5d4d5bcec53a62a0e60
.exe windows:5 windows x86 arch:x86

10e94faca41eac472497ac45a13296c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

framcu32

_LDenorm
_Eps
_FSnan
_FDtest
_Xbig
_Getctype

user32

LoadImageW
GetClassNameW
SetMenuItemInfoW
SetCursor
LoadAcceleratorsW
GetSystemMetrics
DrawFrameControl
GetDC
CreateDialogParamW
LoadBitmapW
LockSetForegroundWindow
GetKeyState
GetCursorPos
LockWindowUpdate
GetMenuItemCount
GetMessagePos
InsertMenuW
DrawTextExW
CallNextHookEx
CallWindowProcW
MessageBeep
FillRect
RedrawWindow
LoadCursorW

msvcrt

_stricmp
wcscoll
fclose
__setusermatherr
__getmainargs
qsort

kernel32

HeapDestroy
ExitProcess
GetVersion
FindNextFileW
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
LoadLibraryW
GetProcessHeap
CreateIoCompletionPort
GetPriorityClass
GetUserDefaultLCID
InterlockedDecrement
GetLocaleInfoW
VirtualAllocEx
FlushInstructionCache
CloseHandle
CreateMutexW
ExpandEnvironmentStringsW
GetCurrentProcessId
GetStartupInfoA
DeleteCriticalSection
GetVolumePathNamesForVolumeNameW
ReadDirectoryChangesW
SleepEx
HeapReAlloc
InterlockedIncrement

gdi32

GetObjectA
CreateDIBSection
CreateFontIndirectW
DeleteDC

ntdll

NtPulseEvent
NtQueryDirectoryObject
NtOpenEventPair
ZwOpenSemaphore
NtCancelTimer
NtReleaseMutant
NtClose
NtOpenDirectoryObject

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10e94faca41eac472497ac45a13296c1

Headers

DLL Characteristics

File Characteristics

Imports

framcu32

user32

msvcrt

kernel32

gdi32

ntdll

Sections

.text Size: 21KB - Virtual size: 21KB

.data Size: 38KB - Virtual size: 37KB

.rsrc Size: 114KB - Virtual size: 116KB

.text
Size: 21KB - Virtual size: 21KB

.data
Size: 38KB - Virtual size: 37KB

.rsrc
Size: 114KB - Virtual size: 116KB