2923fcdc2e042b2f0ce54949ebe96961

Sharing

Copy URL Twitter E-mail

General

Target

2923fcdc2e042b2f0ce54949ebe96961
Size

85KB
MD5

2923fcdc2e042b2f0ce54949ebe96961
SHA1

aadfea0b5eee216fcf8416ef228aed2e5c0e7c87
SHA256

dcac4a92bd52ee809a821f3d4dfc40925b1730cd3be7e45109858e6264014396
SHA512

7e11a4241baa2f9138246678fbbeeea37be263942c369d6747db48081b5419681243695a7df66490171446038729134ac0a2ccdfb3d3029c0fdab711f2944ed3
SSDEEP

1536:SPhR8n03RVxOp4qmDbBZEYUIgf8OxAWIlgTSND4s20gQnjVvo4TRRlL:SJR8ngRDpDTm38Oxal6U4sQwRRx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2923fcdc2e042b2f0ce54949ebe96961

Files

2923fcdc2e042b2f0ce54949ebe96961
.exe windows:5 windows x86 arch:x86

8d71d0a171e1fd5300ee4ef107409e13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DosPathToSessionPathA
InterlockedIncrement
GetConsoleAliasExesLengthW
CreateHardLinkW
GetSystemTimeAsFileTime
GetCurrentProcessId
WinExec
VirtualAlloc
GetTickCount
GetModuleHandleW
QueryPerformanceCounter
GetProcAddress
GetVolumeNameForVolumeMountPointA
lstrlenW
IsDebuggerPresent
WriteConsoleOutputCharacterA
GetSystemTime
GetVersionExA
GetConsoleSelectionInfo
LoadLibraryA
GetConsoleOutputCP
HeapCreate
GetCurrentThreadId
InvalidateConsoleDIBits
ExpungeConsoleCommandHistoryW
EnumDateFormatsW

mscat32

CryptCATCDFClose
CryptCATGetAttrInfo
CryptCATEnumerateCatAttr
CryptCATVerifyMember
CryptCATCDFEnumCatAttributes
MsCatConstructHashTag
CryptCATOpen
CryptCATPutMemberInfo
CryptCATHandleFromStore
CryptCATCDFEnumMembersByCDFTag
CryptCATAdminReleaseCatalogContext
CatalogCompactHashDatabase

wtsapi32

WTSSendMessageW
WTSSendMessageA
WTSQueryUserConfigW
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserToken
WTSVirtualChannelPurgeInput
WTSLogoffSession
WTSSetUserConfigA
WTSSetSessionInformationW
WTSVirtualChannelPurgeOutput

olecli32

MfChangeData
DefCreateLinkFromFile
PbDraw
OleSetData
GenEqual
OleRenameClientDoc
OleQuerySize
LeQueryType
GetTaskVisibleWindow
GenSetData
PbCreateFromClip
ObjQueryType

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d71d0a171e1fd5300ee4ef107409e13

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

mscat32

wtsapi32

olecli32

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 17KB - Virtual size: 47KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 320B

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 17KB - Virtual size: 47KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 320B