1b8b2db10e40f3b8d92f197f106325c9

Sharing

Copy URL Twitter E-mail

General

Target

1b8b2db10e40f3b8d92f197f106325c9
Size

69KB
MD5

1b8b2db10e40f3b8d92f197f106325c9
SHA1

7703df45f508d18b61a2918829e9d248b70e58b7
SHA256

c6479c98f53276e3658b744963a00bd77b12ad29fce4b5ffa648882c2ab0f804
SHA512

4343efbbb456acc154d09870272d5546a94f0ead770f7a412e8f76eec3b22fc5e490d4d9c9495889f5604b1047d20d556085c0a8ae1090ed930c380cb850403b
SSDEEP

1536:jHMmPeK7z4b8d1msisV7BAhuCxeg+wlOSvZiUDpy/0zH+:jH/tz4Qd19TVouaysOeZrPH+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b8b2db10e40f3b8d92f197f106325c9

Files

1b8b2db10e40f3b8d92f197f106325c9
.exe windows:5 windows x86 arch:x86

c060c6122a1aca72fd4ec68796a01dd9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileType
LockResource
GetModuleHandleA
LocalSize
CloseHandle
LocalFree
SuspendThread
ResumeThread
SetFileAttributesA
GetProcAddress
FreeLibrary
InterlockedExchange
GetLastError
LoadLibraryA
RaiseException
LocalReAlloc
GetFileAttributesA
HeapDestroy
GetProcessHeap
LockFile
UnlockFile
CompareFileTime
SystemTimeToFileTime
GlobalAddAtomA
LoadResource
GetCommandLineW
FindResourceW
lstrcmpA
FindResourceA
lstrcpyA
GetSystemTime
VirtualProtectEx
MulDiv
SetFileTime
ExpandEnvironmentStringsA
GetModuleHandleW
SetEnvironmentVariableW
GetCurrentProcess
GetFileInformationByHandle
WaitForMultipleObjects
LocalAlloc

user32

IsCharAlphaNumericA
GetWindow
SetClipboardViewer
UpdateWindow
GetClipboardViewer
SetWindowPos
SetCursorPos
MessageBoxA
GetDC
OpenIcon
EndPaint
SetWindowRgn
DrawTextW
GetParent
IsWindowEnabled
SetParent
BeginPaint
TranslateMessage
GetWindowTextW
PeekMessageA
TranslateAcceleratorA
SetClassLongA
GetWindowRgn
CreateWindowExW
DispatchMessageA
ValidateRgn
CallWindowProcA
SetWindowTextW
SetMessageQueue
GetMessageTime
GetMessagePos
GetClassLongA
MoveWindow
GetWindowLongW
GetClassWord
SwitchToThisWindow

gdi32

DPtoLP
GetCharWidthA
GetTextMetricsW
SetDCPenColor
Chord
GetPixel
RestoreDC
GetDeviceCaps
UnrealizeObject
DeleteObject
CreateCompatibleDC
GetObjectW
GetDCPenColor
SetTextJustification

advapi32

RevertToSelf
ImpersonateNamedPipeClient
ImpersonateSelf
GetOldestEventLogRecord
GetEventLogInformation
DeregisterEventSource
WriteEncryptedFileRaw
CloseEncryptedFileRaw
GetTokenInformation
ReportEventW

Exports

Exports

_AssignRelativeData@12
_CreateRelativeData@4
_DeleteRelativeData@16
_GetSizeOfRelativeData@4
_SeekRelativeData@4

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GLOBAL
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CONST
Size: 512B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

TLS
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 830B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c060c6122a1aca72fd4ec68796a01dd9

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

GLOBAL Size: 3KB - Virtual size: 3KB

CONST Size: 512B - Virtual size: 560B

TLS Size: 512B - Virtual size: 128B

.rsrc Size: 80KB - Virtual size: 80KB

.reloc Size: 1024B - Virtual size: 830B

.text
Size: 13KB - Virtual size: 12KB

GLOBAL
Size: 3KB - Virtual size: 3KB

CONST
Size: 512B - Virtual size: 560B

TLS
Size: 512B - Virtual size: 128B

.rsrc
Size: 80KB - Virtual size: 80KB

.reloc
Size: 1024B - Virtual size: 830B