44c64200b293147a184307799d5d2207

Sharing

Copy URL Twitter E-mail

General

Target

44c64200b293147a184307799d5d2207
Size

29KB
MD5

44c64200b293147a184307799d5d2207
SHA1

d51fdcea0d53ff6e5f45bb8f43d70371dc366ea4
SHA256

fee876e8624888ee2f5170a545e7a7aae8519399845c753c37ace05eee41429d
SHA512

623107b28ee90e8839e9e58513a93db743927f46800d95d864b6d54cec70e9f865309d622b89cb15a7e0792ba6bef827ba3c8e4a60c3de51f89895c92692086b
SSDEEP

768:gvfNLzvihynhapMXkM+FhCeRclG2Iweejn2AX:gXNfiwaCXkR4eRclUw1yAX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44c64200b293147a184307799d5d2207

Files

44c64200b293147a184307799d5d2207
.exe windows:6 windows x86 arch:x86

a2888c1c669df960fa9bf31a11ecc7ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
TraceMessage

kernel32

SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
InterlockedDecrement
InterlockedIncrement
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetVersion
GetLastError
WaitForSingleObject
CreateEventW
CreateProcessW
SetEvent
CompareStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc

user32

SendMessageW
FindWindowW
UnregisterClassA

msvcrt

_ismbblead
??3@YAXPAX@Z
memset
_vsnwprintf
memcpy_s
_CxxThrowException
_wcsicmp
_vscwprintf
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_controlfp
_XcptFilter
_exit
_cexit
__getmainargs
free
??_U@YAPAXI@Z
??_V@YAXPAX@Z
wcschr
??2@YAPAXI@Z
__CxxFrameHandler3
wcstok
memmove_s
vswprintf_s

oleaut32

SysAllocString
SysFreeString

shlwapi

StrRStrIW

ole32

CreateBindCtx
CoRegisterClassObject
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateInstance
CoRevokeClassObject

setupapi

SetupDiOpenDevRegKey
SetupDiOpenDeviceInterfaceW
SetupDiGetClassDevsExW
SetupDiGetDeviceInterfaceAlias
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

shell32

ord155
ShellExecuteExW
SHParseDisplayName

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wkpopci
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a2888c1c669df960fa9bf31a11ecc7ab

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

oleaut32

shlwapi

ole32

setupapi

shell32

Sections

.text Size: 23KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 30KB

wkpopci Size: - Virtual size: 4KB

.text
Size: 23KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 30KB

wkpopci
Size: - Virtual size: 4KB