1c8a13cf42b633642f9a69d4c75fcea5

Sharing

Copy URL Twitter E-mail

General

Target

1c8a13cf42b633642f9a69d4c75fcea5
Size

63KB
MD5

1c8a13cf42b633642f9a69d4c75fcea5
SHA1

b2a95043ec93099c39be2a82319b303ef453c20a
SHA256

723d49fc52701fa631abec121017b545c77e5d93e984ac01ed9bd9941d6e4394
SHA512

75feff735dfa543d948d225b741621638ed295db8b943c8070421b0b1b1a2a4a10a4afd082db14829072e413917083eb1e634cd09e3cb87e7d7ee87760f37399
SSDEEP

768:E8dI69wzKlsLtBeuCyEhVbGzcDeilpaukovbtf3kWd82V6AUAjOIsxPCVmA394Am:qksL9OVzQuko5seNV6AUAjdsmt4AWvlD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c8a13cf42b633642f9a69d4c75fcea5

Files

1c8a13cf42b633642f9a69d4c75fcea5
.exe windows:4 windows x86 arch:x86

9cbe26731976fb0888e46224a8df7b52

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

?terminate@@YAXXZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
_onexit
__dllonexit
??1type_info@@UAE@XZ
strcpy
wcstombs
atoi
towlower
tolower
rand
srand
_itow
mbstowcs
strtok
memset
free
malloc
_itoa
strlen
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
??_U@YAPAXI@Z
memmove
memcpy
??_V@YAXPAX@Z
_except_handler3

kernel32

WriteProcessMemory
FlushFileBuffers
CreateRemoteThread
VirtualFreeEx
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
lstrcmpiW
Process32NextW
CreateFileW
GetCurrentProcess
GetFileSize
VirtualAlloc
ReadFile
VirtualFree
GetModuleFileNameW
CreateThread
lstrcpyW
CreateMutexW
GetLastError
WaitForSingleObject
WaitForMultipleObjects
GetExitCodeThread
lstrlenW
OpenMutexW
GetProcAddress
GetModuleHandleA
Sleep
WriteFile
SetFilePointer
SetEndOfFile
ReleaseMutex
GetModuleFileNameA
DisableThreadLibraryCalls
ExitProcess
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
GetLogicalDriveStringsW
GetDriveTypeW
DeleteFileW
GetTickCount
CreateDirectoryW
RaiseException
SystemTimeToFileTime
SetFileTime
Process32First
GetCurrentProcessId
Process32Next
GetWindowsDirectoryA
GetVolumeInformationA
GetCurrentThread
CreateProcessW
OpenMutexA
OpenEventA
TerminateThread
CreateEventW
TerminateProcess
SetFileAttributesW
WideCharToMultiByte
HeapAlloc
GetProcessHeap
HeapFree
InterlockedIncrement
InterlockedDecrement
GetVersion
InterlockedExchange
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAllocEx
OpenProcess
GetVersionExA
CloseHandle
lstrcatA
lstrcpyA
lstrlenA
LocalAlloc
lstrcatW
GetSystemTime

user32

GetSystemMetrics
UnhookWindowsHookEx
PostMessageA
SetWindowsHookExA
CallNextHookEx

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
QueryServiceStatusEx
QueryServiceConfigA
CloseServiceHandle
SetThreadToken
GetLengthSid
SetTokenInformation
DuplicateTokenEx
GetTokenInformation
SetEntriesInAclA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ChangeServiceConfigA
ControlService
OpenServiceA
OpenSCManagerA
ConvertSidToStringSidW
IsValidSid
RegCreateKeyExW
RegDeleteValueW
RegFlushKey
RegCloseKey
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
SetSecurityInfo
OpenProcessToken

Exports

Exports

DllCanUnloadNow
DllGetClassObject
s

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cbe26731976fb0888e46224a8df7b52

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 6KB - Virtual size: 44KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 6KB - Virtual size: 44KB

.reloc
Size: 4KB - Virtual size: 3KB