2670d53f566b9f512ee6a72897c4fbd6

Sharing

Copy URL

Twitter E-mail

General

Target

2670d53f566b9f512ee6a72897c4fbd6
Size

161KB
MD5

2670d53f566b9f512ee6a72897c4fbd6
SHA1

8b7f50cb363fa28e60c053c6195f81492a2ba106
SHA256

561ec76730a2d3e3e8a573b2147ddb3491e6f03815c11e613f3186b27fc26083
SHA512

b9cf7f4352904896d4e553fe06cf998eaa48b376c470eb0da5a36f6283a3c0d3ff35174495f2bdcaf91b512b176f2bab66fdc99ef654d80232dc00dc96a59333
SSDEEP

3072:LSsyw+V+m6kD8wwTel5ZG0F8anySQiQZzRrBG7DKQep8bT:Fyw+V+mRDZB3ySTuQVf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2670d53f566b9f512ee6a72897c4fbd6

Files

2670d53f566b9f512ee6a72897c4fbd6
.exe windows:5 windows x86 arch:x86

9102f05b26fb6d8b6551dbc820c6d9a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
GetVersionExW
CreateProcessW
GetCurrentProcess
lstrcpyW
CopyFileW
lstrcatW
GetTempPathW
DeleteCriticalSection
InitializeCriticalSection
GetUserDefaultUILanguage
GetModuleFileNameW
OutputDebugStringA
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
WaitForSingleObject
CreateProcessA
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetLocaleInfoA
GetLastError
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
HeapAlloc
RaiseException
RtlUnwind
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LCMapStringA
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW

user32

IsHungAppWindow
FindWindowW

advapi32

RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
CreateProcessAsUserW
GetLengthSid
SetTokenInformation
DuplicateTokenEx
OpenProcessToken
GetTokenInformation
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegFlushKey

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

crypt32

CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptQueryObject

wintrust

WinVerifyTrust

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mysec
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.krdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9102f05b26fb6d8b6551dbc820c6d9a0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

psapi

crypt32

wintrust

Sections

.text Size: 59KB - Virtual size: 58KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 7KB

mysec Size: 512B - Virtual size: 4B

.rsrc Size: 512B - Virtual size: 448B

.reloc Size: 7KB - Virtual size: 6KB

.krdata Size: 68KB - Virtual size: 68KB

.text
Size: 59KB - Virtual size: 58KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 7KB

mysec
Size: 512B - Virtual size: 4B

.rsrc
Size: 512B - Virtual size: 448B

.reloc
Size: 7KB - Virtual size: 6KB

.krdata
Size: 68KB - Virtual size: 68KB