43d6a763015a6eb1296090c83b23a4ef

Sharing

Copy URL Twitter E-mail

General

Target

43d6a763015a6eb1296090c83b23a4ef
Size

59KB
MD5

43d6a763015a6eb1296090c83b23a4ef
SHA1

8003de15e69112edefdabbb4632612762ce7a7a1
SHA256

ff92eb6e2a768fbd9032d223915a43f5a51355a526b3760b2b12085504d4c61e
SHA512

3a211730819421d15d66375d0395e47db008aa8e645fa19d09346ecb98bbd8aea58b0395cc59479539a9423132026dc2e0c88a4cce574eee0f6a623f2f7005e4
SSDEEP

1536:xBxy8oCyk43Gs1+VEaikNzShepROvCZQKIPuJb:xBx/fdikdSh4OvCZGmJb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43d6a763015a6eb1296090c83b23a4ef

Files

43d6a763015a6eb1296090c83b23a4ef
.exe windows:4 windows x86 arch:x86

6965abe8c38a3d8cc2de749c0ccb6fe6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenEventLogA
GetSecurityDescriptorControl
CryptSetProviderExA
RegReplaceKeyA
InitiateSystemShutdownA
FindFirstFreeAce
GetKernelObjectSecurity
SetNamedSecurityInfoA
InitializeSecurityDescriptor
BuildImpersonateExplicitAccessWithNameA
OpenServiceA
CopySid
CryptEnumProvidersA
CryptVerifySignatureA
CryptSignHashA
CloseServiceHandle
CryptEnumProviderTypesA
SetServiceStatus
CryptAcquireContextA
GetSecurityInfo
SetAclInformation
GetAuditedPermissionsFromAclA
ObjectOpenAuditAlarmA
CryptHashData
GetSecurityInfoExA
ImpersonateLoggedOnUser
GetCurrentHwProfileA
GetSecurityDescriptorSacl
OpenBackupEventLogA
GetPrivateObjectSecurity
QueryServiceStatus
ImpersonateSelf
RegCreateKeyExA
OpenProcessToken
EqualPrefixSid
AdjustTokenPrivileges
RegCreateKeyA
InitializeAcl
GetSecurityDescriptorOwner
RegGetKeySecurity
CryptDestroyKey
GetSidLengthRequired
DuplicateToken
GetSidIdentifierAuthority
QueryServiceConfigA
RegConnectRegistryA
GetServiceKeyNameA
DeleteAce

user32

DdeKeepStringHandle
RegisterLogonProcess
PostMessageA
OemKeyScan
GetForegroundWindow
OpenWindowStationA
SetFocus
SetCaretPos
OpenClipboard
EndDialog
LockWindowUpdate
CallMsgFilter
GetMessageTime
DdeDisconnectList
CreatePopupMenu
GetInputDesktop
DdeSetUserHandle
CopyAcceleratorTableA
MessageBeep
DialogBoxParamA
GetMenuStringA
CascadeChildWindows
TranslateMDISysAccel
TabbedTextOutA
SetLastErrorEx
CheckDlgButton
CreateDialogIndirectParamA
GetProcessWindowStation
GetUserObjectSecurity
EnumPropsA
IsIconic
GetTopWindow
DdeAddData
SendInput
ChildWindowFromPoint
GetKeyboardLayoutNameA
SwapMouseButton
SetWindowRgn
GetSubMenu
ArrangeIconicWindows
DdeGetData
GetClassLongA

Sections

.qbopqf
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dwxwp
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.robgl
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mvctkv
Size: 27KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6965abe8c38a3d8cc2de749c0ccb6fe6

Headers

File Characteristics

Imports

advapi32

user32

Sections

.qbopqf Size: 22KB - Virtual size: 45KB

.dwxwp Size: 5KB - Virtual size: 10KB

.robgl Size: 1024B - Virtual size: 1KB

.mvctkv Size: 27KB - Virtual size: 132KB

.rsrc Size: 2KB - Virtual size: 4KB

.qbopqf
Size: 22KB - Virtual size: 45KB

.dwxwp
Size: 5KB - Virtual size: 10KB

.robgl
Size: 1024B - Virtual size: 1KB

.mvctkv
Size: 27KB - Virtual size: 132KB

.rsrc
Size: 2KB - Virtual size: 4KB