38d81c9e3969a1e51b6da52de7ee4d47

General

Target

38d81c9e3969a1e51b6da52de7ee4d47
Size

226KB
MD5

38d81c9e3969a1e51b6da52de7ee4d47
SHA1

23a5890553e01173de485236149c7460cae81783
SHA256

d1b894b630f02824fce8bd8ad3d88d2da62d344fa6eedd8fd35c1ef0f2245aaf
SHA512

6052cbba6b79ab10f9653860d09355baf8c94d5de1fd238ed6f37cb07ba6be7ae341bc020ca525d55860016c2b9d19a672694bf2731e78666e9c54719944997a
SSDEEP

3072:4yTP0p1U1NOmcxKuwCOmTGtIcg7kGLYR0c0E+uHEiInmr/VNw06GH9HAMSHCkIoo:FumNOXBwJe2rcLPnmrLLoiE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38d81c9e3969a1e51b6da52de7ee4d47

Files

38d81c9e3969a1e51b6da52de7ee4d47
.exe windows:5 windows x86 arch:x86

93682c282e7a9939cec506a8555e98b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCreateKeyExW
RegCreateKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
OpenProcessToken
OpenThreadToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
CopySid
GetLengthSid
GetTokenInformation
RegCloseKey

kernel32

GetLastError
GetCurrentThread
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
GetModuleFileNameA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
GetProcAddress
LoadLibraryA
LCMapStringA
SetLastError
GetLocaleInfoA
GetVersionExA
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetLocaleInfoW
SetStdHandle
SetFilePointer
CloseHandle
TlsAlloc
TlsSetValue
GetCurrentThreadId
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WideCharToMultiByte
HeapAlloc
HeapFree
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetVersion
GetModuleHandleA
MultiByteToWideChar
LCMapStringW
GetCPInfo
LocalAlloc
LocalFree

user32

LoadStringW
LoadStringA
wsprintfW

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 185KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93682c282e7a9939cec506a8555e98b8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

Sections

.text Size: 35KB - Virtual size: 34KB

.data Size: 185KB - Virtual size: 194KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 35KB - Virtual size: 34KB

.data
Size: 185KB - Virtual size: 194KB

.rsrc
Size: 4KB - Virtual size: 3KB