39b1ebd5bdb7ae1235b5ac517730e90e

Sharing

Copy URL

Twitter E-mail

General

Target

39b1ebd5bdb7ae1235b5ac517730e90e
Size

264KB
MD5

39b1ebd5bdb7ae1235b5ac517730e90e
SHA1

49c27de0ca61f422f9fe839d58e502f260ccbb82
SHA256

2e9324908a6c0f50f40058d7a5729eb6646907a056b48a888e73e97998c4ee51
SHA512

d4bcf6d84c61755721bebc0dfbcf42d5935cf349cba3bcb613a363d6d05c841d080977068eb42e162befe9eb3a4bf5ecceacdd03c395b7fcf2e9084ebe14ec26
SSDEEP

6144:1nEaQC3iA8y0L85JIqXYhHsntwoOaNNCGwDj6VkAB:qaQI49gYQtwoHNCGwSVkAB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39b1ebd5bdb7ae1235b5ac517730e90e

Files

39b1ebd5bdb7ae1235b5ac517730e90e
.exe windows:4 windows x86 arch:x86

a557734e4e71add78760c5e21ec3fc68

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
FindResourceA
WaitForSingleObject
GetModuleFileNameA
GetVersionExA
Sleep
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
GetCurrentProcess
FreeLibrary
GetLastError
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetProcessHeap
HeapCreate
ExitProcess
TlsAlloc
GetStartupInfoA
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
CreateMutexA
GetProcAddress

advapi32

OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
ChangeServiceConfigA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DeleteService

dhcpsapi

DhcpAddServer
DhcpCreateClientInfo
DhcpAddSubnetElement
DhcpEnumClasses
DhcpServerRestoreDatabase
DhcpAddMScopeElement
DhcpEnumServers
DhcpEnumSubnetClientsV4
DhcpServerQueryDnsRegCredentials
DhcpCreateOption
DhcpSetOptionInfo
DhcpGetMibInfo
DhcpServerSetConfig
DhcpGetThreadOptions

msrating

ClickedOnRAT

Sections

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.h
Size: 5KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 93KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.FbIJK
Size: 5KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 126KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.W
Size: 512B - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a557734e4e71add78760c5e21ec3fc68

Headers

File Characteristics

Imports

kernel32

advapi32

dhcpsapi

msrating

Sections

.edata Size: 5KB - Virtual size: 5KB

.h Size: 5KB - Virtual size: 22KB

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 7KB

.edata Size: 93KB - Virtual size: 118KB

.FbIJK Size: 5KB - Virtual size: 391KB

.data Size: 6KB - Virtual size: 66KB

.edata Size: 126KB - Virtual size: 216KB

.W Size: 512B - Virtual size: 49KB

.rsrc Size: 2KB - Virtual size: 1KB

.edata
Size: 5KB - Virtual size: 5KB

.h
Size: 5KB - Virtual size: 22KB

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 7KB

.edata
Size: 93KB - Virtual size: 118KB

.FbIJK
Size: 5KB - Virtual size: 391KB

.data
Size: 6KB - Virtual size: 66KB

.edata
Size: 126KB - Virtual size: 216KB

.W
Size: 512B - Virtual size: 49KB

.rsrc
Size: 2KB - Virtual size: 1KB