1c56d55adf8358c0eef7264478f2921a

Sharing

Copy URL Twitter E-mail

General

Target

1c56d55adf8358c0eef7264478f2921a
Size

324KB
MD5

1c56d55adf8358c0eef7264478f2921a
SHA1

5a0ab88b85d1f5e87655640697c406cae3dbc808
SHA256

dbc13eac189070b8d1798d7a76bd02e00288562537e68626b3d1c887c5f28ec1
SHA512

5bbffd7491b4f680972582eba370a23bcd6e09e196a9a0512f3ff4d4df6861e888cd1aa3745e14d720239a81ba3d938b75d822f1a9c7c86c5ba8b988423d279e
SSDEEP

6144:8CmxrdAv1Kb9oGjsRrqZ+yILzvupgSrt6rM+WxKbRv:Yyv1hGjs3PuZC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c56d55adf8358c0eef7264478f2921a

Files

1c56d55adf8358c0eef7264478f2921a
.exe windows:5 windows x86 arch:x86

91c094fb652ef2830e021b9f5f867e41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantClear

kernel32

DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
lstrcmpiW
GetLastError
HeapDestroy
MultiByteToWideChar
lstrlenW
LoadResource
lstrlenA
FindResourceW
GetModuleFileNameW
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
SizeofResource
lstrcpynW
InterlockedDecrement
LoadLibraryExW
GetStartupInfoA
lstrcatW
GetACP

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

ntdll

RtlAddAccessAllowedAceEx
RtlAdjustPrivilege
NtAllocateVirtualMemory

rpcrt4

RpcStringFreeW

advapi32

RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW

msvcrt

wcsncat
__CxxFrameHandler
free
wcscpy
wcsncpy
_adjust_fdiv
malloc
realloc
_purecall
wcslen
_initterm
_except_handler3

user32

CharNextW

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

91c094fb652ef2830e021b9f5f867e41

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

kernel32

ole32

ntdll

rpcrt4

advapi32

msvcrt

user32

Sections

.text Size: 9KB - Virtual size: 8KB

.rsrc Size: 12KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 1.4MB

.rdata Size: 298KB - Virtual size: 298KB

.tls Size: 512B - Virtual size: 4KB

.text
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 12KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 1.4MB

.rdata
Size: 298KB - Virtual size: 298KB

.tls
Size: 512B - Virtual size: 4KB