4724b88350d0d997e1a1f09c5da052d6

Sharing

Copy URL Twitter E-mail

General

Target

4724b88350d0d997e1a1f09c5da052d6
Size

101KB
MD5

4724b88350d0d997e1a1f09c5da052d6
SHA1

5cbe3b0de091c7cb84c75b5c7ed1815fc18c845a
SHA256

a23e45542d4372edeac83dc4bb17a624df495d180d1cf61310c76b0efe9e5c5c
SHA512

0809884d796e9e3f6a31820476231350b3d86d58d8302028f23ace2e8018f0e5ee3d011efd9f21bd4cc02812c64e5be38f666a0f480b0fd7d05a5a1dc065da7a
SSDEEP

3072:PBKvV9Wd/IuccCxqz0n9iu8YTMZ6FuikLF:p29A/IhHxqwnAIAo4ieF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4724b88350d0d997e1a1f09c5da052d6

Files

4724b88350d0d997e1a1f09c5da052d6
.exe windows:6 windows x64 arch:x64

066aee023b4f62e28bcf1e4947ed046b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
RegCreateKeyExW
GetTraceEnableFlags
RegQueryInfoKeyW
GetTraceLoggerHandle
RegDeleteValueW
UnregisterTraceGuids
RegEnumValueW
RegOpenKeyExW
GetTraceEnableLevel
RegEnumKeyExW
RegCloseKey
RegisterTraceGuidsW
RegSetValueExW
RegQueryValueExW

kernel32

EnterCriticalSection
GetCurrentThreadId
DeleteFileW
GetCommandLineW
lstrlenA
VirtualQuery
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
WaitForSingleObject
SetEvent
InitializeCriticalSection
LoadLibraryW
GetCurrentProcess
SizeofResource
SetLastError
HeapDestroy
lstrcpynW
GetModuleFileNameW
MultiByteToWideChar
GetProcAddress
VirtualAlloc
CreateEventW
GetSystemInfo
lstrcmpiW
lstrcatW
VirtualProtect
DeleteCriticalSection
CloseHandle
lstrcpyW
CreateThread
GetLastError
RaiseException
FlushInstructionCache
GlobalUnlock
lstrlenW
lstrcmpW
LeaveCriticalSection
GlobalAlloc
GetModuleHandleW
GetVersionExW
GlobalLock
CompareStringW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
Sleep
HeapAlloc
HeapFree
VirtualFree
GetProcessHeap
InterlockedPopEntrySList
InterlockedPushEntrySList
GetStartupInfoW
SetUnhandledExceptionFilter
ExpandEnvironmentStringsW

gdi32

DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetStockObject
CreateSolidBrush
BitBlt

user32

PostMessageW
UnregisterClassW
SetCapture
IsChild
FillRect
RegisterWindowMessageW
GetWindowTextLengthW
DestroyWindow
EndPaint
DispatchMessageW
PostThreadMessageW
CharPrevW
CharNextW
GetMessageW
SetParent
GetWindowLongPtrW
GetFocus
CreateAcceleratorTableW
SetFocus
BeginPaint
GetClassInfoExW
wsprintfW
GetDC
RegisterClassExW
SetClassLongPtrW
InvalidateRect
GetWindowLongW
GetWindowTextW
GetClassNameW
ReleaseDC
GetDlgItem
SetWindowLongW
RedrawWindow
GetDesktopWindow
GetSysColor
GetParent
InvalidateRgn
GetClientRect
LoadCursorW
SetWindowPos
ShowWindow
CreateWindowExW
ReleaseCapture
SetWindowLongPtrW
SendMessageW
SetWindowTextW
CallWindowProcW
DefWindowProcW
GetWindow
IsWindow

msvcrt

_cexit
memcmp
memset
_vsnwprintf
wcspbrk
wcsrchr
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
memcpy
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
realloc
malloc
free
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
??_U@YAPEAX_K@Z
wcschr

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

ole32

CoCreateInstance
OleLockRunning
CLSIDFromProgID
StringFromCLSID
CLSIDFromString
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
CoTaskMemRealloc
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
OleUninitialize
OleInitialize
CreateStreamOnHGlobal

oleaut32

RegisterTypeLi
SysAllocString
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysFreeString
OleCreateFontIndirect
SysAllocStringLen
VariantClear
SysStringLen

shell32

SHCreateItemFromIDList
SHParseDisplayName
ord155

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

066aee023b4f62e28bcf1e4947ed046b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

ole32

oleaut32

shell32

Sections

.text Size: 64KB - Virtual size: 64KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 28KB - Virtual size: 29KB

.text
Size: 64KB - Virtual size: 64KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 28KB - Virtual size: 29KB