259c9da4fc8ea296c19641307faa3b39

General

Target

259c9da4fc8ea296c19641307faa3b39
Size

383KB
MD5

259c9da4fc8ea296c19641307faa3b39
SHA1

adca09c02ffc1c6df4ce923e8a3dcf72732165ca
SHA256

817c25f1579f4620d57635353f53a93b19f73dc92c23889d38855fb978063cfa
SHA512

722013b4029846d0695071960547b0f21a32d4f46edccb8c232ac6a36c2963c4cfcc07322cf7578a2749889087b74d22454de0d5287af7f2c11abaa8656807a0
SSDEEP

6144:btEl31QrxeiAc+0xcFEPun2qTXtv5Xvx+anYM0Izc9/1r+/w+J5CGgu2Lu4sNE2x:btk31Qt/x+0xcuPGTXR57nY3Iw9tq/hP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
259c9da4fc8ea296c19641307faa3b39

Files

259c9da4fc8ea296c19641307faa3b39
.exe windows:4 windows x86 arch:x86

6ddb1388febdddc1c8dc84b57849acec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
VirtualQuery
WriteFile
CreateWaitableTimerW
RtlUnwind
GetEnvironmentStringsA
QueryPerformanceCounter
GetCurrentProcess
GetProcAddress
VirtualAlloc
GetCurrentThreadId
lstrcmp
HeapReAlloc
HeapAlloc
SetLocaleInfoW
GetUserDefaultLCID
HeapFree
InterlockedExchange
GetModuleFileNameA
TerminateProcess
GetModuleHandleA
ExitProcess
GetConsoleScreenBufferInfo
GetConsoleCursorInfo
GetProfileStringA
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime

advapi32

CryptGetDefaultProviderA
RegDeleteKeyA
CryptSignHashA
CryptExportKey
CryptSetProvParam
RegSetValueExW
LookupAccountNameA
DuplicateToken
RegReplaceKeyW
RegSetValueA
CryptContextAddRef
RegNotifyChangeKeyValue
ReportEventA
CryptGetDefaultProviderW
RegOpenKeyA
CryptSetProviderExW
RegCreateKeyW
RegLoadKeyA
DuplicateTokenEx

shell32

SHGetSpecialFolderLocation
FindExecutableA
SHGetDataFromIDListA
SHGetSpecialFolderPathW
DragQueryPoint
SHFileOperationW
ExtractIconA
SHEmptyRecycleBinW
RealShellExecuteExW
ExtractIconExW
ShellHookProc
ExtractAssociatedIconA
SHGetFileInfoW
SHChangeNotify
SHLoadInProc
SHInvokePrinterCommandA
SHBrowseForFolderW
SHGetInstanceExplorer
SHGetSpecialFolderPathA

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ddb1388febdddc1c8dc84b57849acec

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

Sections

.text Size: 105KB - Virtual size: 104KB

.data Size: 263KB - Virtual size: 263KB

.rsrc Size: 13KB - Virtual size: 13KB

.text
Size: 105KB - Virtual size: 104KB

.data
Size: 263KB - Virtual size: 263KB

.rsrc
Size: 13KB - Virtual size: 13KB