435f51b85cd1c475a1122b8626aba29c

Sharing

Copy URL Twitter E-mail

General

Target

435f51b85cd1c475a1122b8626aba29c
Size

56KB
MD5

435f51b85cd1c475a1122b8626aba29c
SHA1

531d1ed460796343b82c2d28e365aa6548f29b85
SHA256

e8caa55d72233b4f1d348b26ee9086bc535349dff692724da8b257763bcefd41
SHA512

e66c22d34ac60b63c468d17ea161475a63a32fe5b7efb17e2bd8e874f0f29cb140f627dd9813a96092cf75473c8ee3722ae927736441200f464567d4a37590ad
SSDEEP

768:tm4OZOPovKnQ8p4KA4JkjX4jSmfxnYS/V7P2VckV3D:tmxZWoCnKpm5YS/VED

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
435f51b85cd1c475a1122b8626aba29c

Files

435f51b85cd1c475a1122b8626aba29c
.exe windows:4 windows x86 arch:x86

dfc8608a2649d0d4bf85162c9f36f125

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

argana

ARGUSXmlCreate
ARGUSXmlCloseCurrentStructure
ARGUSXmlFree
ARGUSTemplateFilterDestroy
ARGUSTemplateProcessEx
ARGUSTemplateFilterRegisterCB
ARGUSTemplateFilterCreate
ARGUSXmlGetAction
ARGUSXmlCloseTabRow
ARGUSAnaCreate
ARGUSAnaRun
ARGUSAnaFree
ARGUSGetParamValForName
ARGUSXmlWriteMessage
ARGUSXmlOpenTabStructure
ARGUSXmlAddTabHeaderItem
ARGUSXmlWriteTabHeader
ARGUSXmlOpenTabRow
ARGUSXmlWriteTabItem

argutl

ARGUSStrCreateObjectId
ARGUSStrRestoreSpecialChars
ARGUSStrDestroyObjectId

sagrgs5

rgs_get_registry_value

sagovo5

ovo_wsetlocale
ovo_wgetlocale

msvcr80

_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
strstr
strncpy
memset
sprintf
atol
atoi
_access
exit
wcsncpy
wcstombs
printf
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryA
GetProcAddress

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfc8608a2649d0d4bf85162c9f36f125

Headers

File Characteristics

Imports

argana

argutl

sagrgs5

sagovo5

msvcr80

kernel32

Sections

.text Size: 8KB - Virtual size: 6KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 6KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 1KB