474ba7d44af41b4a6ce6851e2327b0a0

Sharing

Copy URL Twitter E-mail

General

Target

474ba7d44af41b4a6ce6851e2327b0a0
Size

403KB
MD5

474ba7d44af41b4a6ce6851e2327b0a0
SHA1

b4c6ae799b15aca5255a1bd2bc3015d36e50ca40
SHA256

fa9306d4011b55b0c901b45677053234841124d3a284a79d1f8749bc525c6fe4
SHA512

9a8350199d74a1396e1a8c1f47a1a128d340c16f3374ef522857daffd2c8a8ce8d9fa113b16a395899b83196934fd796f2c1123c1e1020713ec582738ce4ebf9
SSDEEP

6144:/xuo2yJlUQ6/wi9Y2bxtCiE+AjIOPJyAb5U9Z6d5tayerxHZfOK23IZD3g:/1ubzChjHP0Ab5yq5MZfdSoT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
474ba7d44af41b4a6ce6851e2327b0a0

Files

474ba7d44af41b4a6ce6851e2327b0a0
.exe windows:4 windows x86 arch:x86

ef62f05530d3c2a34934e6a131541099

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryMultipleValuesW
RegLoadKeyA
LookupAccountSidA
CryptDestroyKey
RegOpenKeyExA
LookupAccountSidW
RegQueryValueW
CryptSetProvParam
InitializeSecurityDescriptor
CryptImportKey
RegLoadKeyW
RegConnectRegistryA
CryptHashSessionKey
RegSaveKeyW
CryptGetHashParam
LogonUserW
RegNotifyChangeKeyValue
ReportEventA
RevertToSelf
CryptDestroyHash

wininet

InternetAlgIdToStringA
InternetGetCookieW
InternetOpenUrlA
RegisterUrlCacheNotification
InternetFortezzaCommand
InternetQueryFortezzaStatus
InternetGetCertByURLA

user32

DdeUnaccessData
DdeClientTransaction
DestroyIcon
ReplyMessage
InvalidateRect
GetNextDlgTabItem
LoadKeyboardLayoutA
OffsetRect
ChangeDisplaySettingsExW
CreateDialogIndirectParamW
GetMenuItemInfoW
RealChildWindowFromPoint
CallNextHookEx
SetDoubleClickTime
BringWindowToTop
InSendMessageEx
AdjustWindowRect
CreateAcceleratorTableW
GetSysColorBrush
SetWindowRgn
EnumDesktopWindows
EnumWindowStationsA
LoadCursorW

comdlg32

PageSetupDlgW
GetOpenFileNameW
GetFileTitleW
ChooseFontW

kernel32

GetUserDefaultLCID
GetTimeFormatA
SetLocaleInfoA
LoadLibraryW
RtlUnwind
EnumResourceNamesW
EnumSystemLocalesA
GetStartupInfoW
LoadLibraryA
SetEnvironmentVariableA
GetModuleFileNameA
GetModuleFileNameW
IsValidLocale
VirtualAlloc
PulseEvent
GetProcAddress
GetSystemInfo
lstrcat
TerminateProcess
TlsAlloc
GetCurrentProcess
CompareStringW
WideCharToMultiByte
GetStartupInfoA
IsBadWritePtr
ExitProcess
EnterCriticalSection
GetFileType
WriteFile
QueryPerformanceCounter
FreeEnvironmentStringsA
LCMapStringA
VirtualQuery
LeaveCriticalSection
GetLocaleInfoA
GetDriveTypeW
GetTimeZoneInformation
MultiByteToWideChar
GetStringTypeW
TlsFree
GetEnvironmentStrings
EnumCalendarInfoExA
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
IsValidCodePage
HeapFree
SetConsoleMode
VirtualFree
HeapDestroy
SetHandleCount
GetCurrentProcessId
HeapSize
VirtualProtectEx
GetLocaleInfoW
LCMapStringW
GetCPInfo
TlsSetValue
DeleteCriticalSection
TlsGetValue
GetDateFormatA
SetLastError
GetFullPathNameA
CompareStringA
GetSystemTimeAsFileTime
GetACP
GetStringTypeA
HeapAlloc
GetStdHandle
InterlockedExchange
GetVersionExA
FreeEnvironmentStringsW
FoldStringW
HeapCreate
GetLastError
InitializeCriticalSection
GetCurrentThreadId
OpenMutexA
HeapReAlloc
GetCurrentThread
VirtualProtect
UnhandledExceptionFilter
GetCommandLineA
GetTickCount
GetModuleHandleA

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 271KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef62f05530d3c2a34934e6a131541099

Headers

File Characteristics

Imports

advapi32

wininet

user32

comdlg32

kernel32

Sections

.text Size: 118KB - Virtual size: 117KB

.data Size: 271KB - Virtual size: 295KB

.rsrc Size: 12KB - Virtual size: 12KB

.text
Size: 118KB - Virtual size: 117KB

.data
Size: 271KB - Virtual size: 295KB

.rsrc
Size: 12KB - Virtual size: 12KB