4630921fcfec88f083ca7676cb29f1de

Sharing

Copy URL Twitter E-mail

General

Target

4630921fcfec88f083ca7676cb29f1de
Size

204KB
MD5

4630921fcfec88f083ca7676cb29f1de
SHA1

db342b47bdcc9267338c21acb1cc54d27514d6ea
SHA256

3a99da1ba4f3bf68c67531a317a272017881d45d406012c14dd3cb8f456f85fa
SHA512

4d249fde715352f1c88c0472fdaf2ff740a3f0e03feb5c5d577e42ddbe49ae0dd60421e18ac413711d5cd0b7c55809edcfba7f0cf8ed67e544ac2e19efce531d
SSDEEP

6144:0QEfD/i1lkemVTtuASZNaEz25TdgVhWCX:ametufNsgr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4630921fcfec88f083ca7676cb29f1de

Files

4630921fcfec88f083ca7676cb29f1de
.exe windows:6 windows x86 arch:x86

aa2b72693aae6a6c6f24564ac3d32728

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
SetFilePointerEx
CloseHandle
WriteConsoleW
DecodePointer
VirtualProtect
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
GetStringTypeW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
RaiseException

msi

ord146
ord161
ord140
ord75
ord52
ord171
ord61

gdi32

SetFontEnumeration
GetDIBits
Escape
GetArcDirection
IntersectClipRect
SelectClipPath

mpr

WNetGetUniversalNameW
WNetGetNetworkInformationW
WNetGetProviderNameW
WNetOpenEnumA
WNetDisconnectDialog1A
WNetAddConnection2A
WNetDisconnectDialog
WNetAddConnectionW

loadperf

LoadPerfCounterTextStringsW
UnloadPerfCounterTextStringsW
UnloadPerfCounterTextStringsA

rtutils

MprSetupProtocolFree
TraceVprintfExA
TracePrintfW
RouterAssert
TraceDeregisterExA
TracePutsExA
TraceDeregisterExW
RouterGetErrorStringW

mscms

GetColorDirectoryA
ord1
TranslateBitmapBits
CheckColors
SpoolerCopyFileEvent
GetCMMInfo
DeleteColorTransform
InstallColorProfileA

user32

MessageBoxW

Sections

.text
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa2b72693aae6a6c6f24564ac3d32728

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msi

gdi32

mpr

loadperf

rtutils

mscms

user32

Sections

.text Size: 175KB - Virtual size: 175KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 3KB - Virtual size: 5KB

.gfids Size: 512B - Virtual size: 180B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: 175KB - Virtual size: 175KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 3KB - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 180B

.rsrc
Size: 512B - Virtual size: 480B