266a0303d1376c408909809de07f7907

Sharing

Copy URL Twitter E-mail

General

Target

266a0303d1376c408909809de07f7907
Size

175KB
MD5

266a0303d1376c408909809de07f7907
SHA1

067ca1b3a703459621edd8a660cc8c07f5740394
SHA256

bdc102c71cec12619426eacf8c4ace82073e996334019b46bd3299dca2256ad0
SHA512

c25e9bf9552c0680bdaf5b87e5f9a2c920286b2b9954463cf4600482360d7496d0b1960bd2f3a48c5b86d0b9a513d0c8c7bad63781f86f52051c96dafef7b476
SSDEEP

3072:EcVUaHYq//wkbTxE5xsdJUfn/K6Y3eIgvTRlMIKnWWhOzSeyZmxphDfH9LLMedHK:EcxYq//nXxS+J0Q3e1Cci6hDP9Lz9J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
266a0303d1376c408909809de07f7907

Files

266a0303d1376c408909809de07f7907
.exe windows:4 windows x86 arch:x86

f5aee6522e196ab0f2d6b7463106c398

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyA

kernel32

EnterCriticalSection
GlobalFindAtomA
VirtualQuery
GetEnvironmentStrings
CreateFileA
GetFullPathNameA
GetLocaleInfoA
EnumCalendarInfoA
LocalAlloc
VirtualAllocEx
GetCommandLineW
GetLocalTime
VirtualFree
GetACP
lstrlenA
GetProcAddress
MulDiv
LocalFree
GetFileAttributesA
FindFirstFileA
GetDiskFreeSpaceA
SetLastError
CreateThread
CreateEventA
GetModuleHandleA
GetOEMCP
LoadResource
GetModuleHandleW
SetErrorMode
GetLastError
SetHandleCount
ReadFile
MoveFileExA
ExitProcess
VirtualAlloc
MoveFileA
HeapFree
GetStdHandle
LoadLibraryA
ExitThread
SetFilePointer
CloseHandle
DeleteCriticalSection
SetEvent
GetUserDefaultLCID
IsBadHugeReadPtr
lstrlenW
SetThreadLocale
FormatMessageA
DeleteFileA
GetCurrentProcessId
GlobalAlloc
lstrcmpA
ResetEvent
LoadLibraryExA
WideCharToMultiByte
lstrcatA
CompareStringA
SizeofResource
HeapAlloc
InitializeCriticalSection

user32

PostMessageA
LoadCursorA
LoadBitmapA
SendMessageA
LoadIconA
SetActiveWindow
LoadStringA
RemovePropA
PeekMessageA
RegisterWindowMessageA
SendMessageW
OemToCharA
OpenClipboard
RemoveMenu
PtInRect
MapVirtualKeyA
RegisterClassA
LoadKeyboardLayoutA
RedrawWindow
PeekMessageW
RegisterClipboardFormatA
ReleaseCapture
PostQuitMessage
OffsetRect
MessageBeep
MessageBoxA
ReleaseDC
ScreenToClient
MapWindowPoints
ScrollWindow

shell32

SHGetDesktopFolder

ole32

CreateStreamOnHGlobal
PropVariantClear
CoGetObjectContext
ReleaseStgMedium
CoReleaseMarshalData

comctl32

ImageList_Destroy
ImageList_DragShowNolock
ImageList_DrawEx
ImageList_Add

Sections

CODE
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 2KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 1024B - Virtual size: 862B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5aee6522e196ab0f2d6b7463106c398

Headers

File Characteristics

Imports

advapi32

kernel32

user32

shell32

ole32

comctl32

Sections

CODE Size: 42KB - Virtual size: 42KB

.rdata Size: 111KB - Virtual size: 111KB

.data Size: 8KB - Virtual size: 7KB

.adata Size: 2KB - Virtual size: 85KB

DATA Size: 8KB - Virtual size: 7KB

.cdata Size: 1024B - Virtual size: 862B

.rsrc Size: 1024B - Virtual size: 864B

CODE
Size: 42KB - Virtual size: 42KB

.rdata
Size: 111KB - Virtual size: 111KB

.data
Size: 8KB - Virtual size: 7KB

.adata
Size: 2KB - Virtual size: 85KB

DATA
Size: 8KB - Virtual size: 7KB

.cdata
Size: 1024B - Virtual size: 862B

.rsrc
Size: 1024B - Virtual size: 864B