20ef897058255186f1d5729235dde24e

Sharing

Copy URL Twitter E-mail

General

Target

20ef897058255186f1d5729235dde24e
Size

126KB
MD5

20ef897058255186f1d5729235dde24e
SHA1

63d01d780450c36e37d39ed75bad7902ef5c4281
SHA256

354941fd7770e884b76d159db4ec1613b4c84df01bce761cb7f76cb63d4d9d4c
SHA512

5689038a010d4f2b2c276251e335aa90ad1059bb9bed829d9f7bfefea92caa496cafcf57f14a69a3cb41e1a402832a16365e46da646a3e5d0d098367eaa0febb
SSDEEP

3072:qcFZGETVwBOBpP6PDgIR44q+PzX25qXDF4JyJX:LTVQO67dR44q6zXTDCJy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20ef897058255186f1d5729235dde24e

Files

20ef897058255186f1d5729235dde24e
.exe windows:4 windows x86 arch:x86

bfa7569d0f47f0088656ec30c376d5ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
UnhandledExceptionFilter
DisableThreadLibraryCalls
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetTickCount
SetUnhandledExceptionFilter

ntdll

NtAllocateVirtualMemory
LdrGetDllHandle
RtlLargeIntegerShiftLeft

rpcrt4

CStdStubBuffer_Connect
CStdStubBuffer_DebugServerRelease
NdrConformantArrayMarshall
NdrProxyErrorHandler
RpcRaiseException
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
NdrSimpleStructMarshall
CStdStubBuffer_Disconnect
NdrCStdStubBuffer2_Release
NdrUserMarshalMarshall
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrSimpleTypeMarshall
NdrPointerBufferSize
NdrStubGetBuffer
NdrDllRegisterProxy
NdrStubInitialize
NdrInterfacePointerBufferSize
NdrConformantStringBufferSize
CStdStubBuffer_DebugServerQueryInterface
NdrProxySendReceive
CStdStubBuffer_CountRefs
NdrConformantArrayBufferSize
NdrPointerFree
CStdStubBuffer_IsIIDSupported
NdrInterfacePointerUnmarshall
NdrProxyFreeBuffer
NdrConformantStringMarshall
NdrDllCanUnloadNow
NdrProxyGetBuffer
NdrSimpleStructBufferSize
NdrInterfacePointerMarshall
CStdStubBuffer_QueryInterface
NdrConformantStringUnmarshall
NdrUserMarshalUnmarshall
NdrStubForwardingFunction
NdrUserMarshalFree
NdrPointerMarshall
NdrDllUnregisterProxy
IUnknown_Release_Proxy
NdrConvert
NdrSimpleStructUnmarshall
NdrConformantArrayUnmarshall
NdrInterfacePointerFree
NdrPointerUnmarshall
NdrClearOutParameters
NdrOleAllocate
CStdStubBuffer_AddRef
NdrStubCall2
NdrProxyInitialize
IUnknown_QueryInterface_Proxy
NdrAllocate
NdrSimpleTypeUnmarshall
NdrOleFree
NdrUserMarshalBufferSize

msvcrt

_except_handler3
_adjust_fdiv
malloc
free
_initterm

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 372KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfa7569d0f47f0088656ec30c376d5ef

Headers

File Characteristics

Imports

kernel32

ntdll

rpcrt4

msvcrt

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 372KB - Virtual size: 984KB

.rdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 372KB - Virtual size: 984KB

.rdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 512B - Virtual size: 20B