1a4816589278a3eaeb6ab35523111403

General

Target

1a4816589278a3eaeb6ab35523111403
Size

379KB
MD5

1a4816589278a3eaeb6ab35523111403
SHA1

3ed47ef1f9fe47d200bf5d442fc2f1333ce1308d
SHA256

227f6b5a844ab3626819a8967b9d3117c52dbc55e38dcadca412d345e94e0f31
SHA512

fbe4ffe0ee022dcd32ad17cb2a47bc810dd87e4b0051eedd342f23ad7ee004428eacd2e0c6ffe14fba8ae5a60578fa797c8b8dd7e6e0645979fc0bbde033daea
SSDEEP

6144:ssu+AibYoYysm3tUC+sAYLSFH5lhP+18KPZ2+P01kycU6tCATolxKTVqbr4qUpr9:rXcCp+spOl4dPN01kS6tC8SeVqb0qUt9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a4816589278a3eaeb6ab35523111403

Files

1a4816589278a3eaeb6ab35523111403
.exe windows:4 windows x86 arch:x86

bc17f1e424680c73e564760787e8a988

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BlockInput
ShowWindow
AnyPopup
NotifyWinEvent
RegisterClassA
UnpackDDElParam

gdi32

CloseEnhMetaFile
SetStretchBltMode

comdlg32

GetSaveFileNameA
ReplaceTextA
GetSaveFileNameW

advapi32

StartServiceW
RegCreateKeyExW
RegSetValueExW
RegLoadKeyA
CryptSetProvParam
InitiateSystemShutdownW
CryptAcquireContextA

kernel32

GetStartupInfoA
EnterCriticalSection
HeapReAlloc
HeapFree
MultiByteToWideChar
QueryPerformanceCounter
HeapAlloc
LoadLibraryA
GetModuleFileNameW
WriteFile
GetVersion
GetStdHandle
VirtualQuery
UnhandledExceptionFilter
LeaveCriticalSection
HeapCreate
WaitForMultipleObjectsEx
FreeEnvironmentStringsW
GetEnvironmentStrings
TlsSetValue
LoadLibraryExW
GetLastError
SetLastError
FreeEnvironmentStringsA
FlushConsoleInputBuffer
GetCommandLineA
InitializeCriticalSection
GetCurrentProcess
GetFileType
TlsGetValue
GetTickCount
HeapDestroy
GetModuleHandleA
ExitProcess
DeleteCriticalSection
SetHandleCount
InterlockedExchange
IsBadWritePtr
GetModuleFileNameA
GetSystemDefaultLCID
TlsFree
TlsAlloc
TerminateProcess
GetProcAddress
GetCommandLineW
GetEnvironmentStringsW
VirtualFree
GetSystemTimeAsFileTime
GetStartupInfoW
VirtualAlloc
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
RtlUnwind

wininet

HttpOpenRequestW
InternetLockRequestFile
InternetSecurityProtocolToStringA
FtpCommandW
InternetSetOptionW

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc17f1e424680c73e564760787e8a988

Headers

File Characteristics

Imports

user32

gdi32

comdlg32

advapi32

kernel32

wininet

Sections

.text Size: 106KB - Virtual size: 106KB

.data Size: 264KB - Virtual size: 264KB

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 106KB - Virtual size: 106KB

.data
Size: 264KB - Virtual size: 264KB

.rsrc
Size: 7KB - Virtual size: 6KB