48783cf8227aae1ff11c0bd3f671fad6

Sharing

Copy URL Twitter E-mail

General

Target

48783cf8227aae1ff11c0bd3f671fad6
Size

1.2MB
MD5

48783cf8227aae1ff11c0bd3f671fad6
SHA1

58c3b3ad0b517d90e8f2b70cc7db898c88c69241
SHA256

cf23901a3fca058bf4aeeff02b453638999c7fd756734fd95f8facf25204528f
SHA512

5cc7e3fe8a0683be48f9976795fc16f5c96f924bc1cfdad50c952a4295deea9da38bf16d338e4417ccd93a9fa74e314b1fd029662d2398ce9c215761ac5df5f2
SSDEEP

24576:pIrDDGeMK1FUlXTb6wtyOpgLd+oXQ8yjk4x3aAsXESLXlkPC:ADDvz1iljblQOc+BaAwdVkq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48783cf8227aae1ff11c0bd3f671fad6

Files

48783cf8227aae1ff11c0bd3f671fad6
.exe windows:5 windows x86 arch:x86

f2d6f7cb1db6f9fc81eff37c1be5c5a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

netapi32

NetWkstaGetInfo
NetShareEnum

syssetup

AsrRestorePlugPlayRegistryData

advapi32

GetAce
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
WriteEncryptedFileRaw
AllocateAndInitializeSid
InitializeAcl
EqualSid
OpenProcessToken

comctl32

InitCommonControlsEx
DestroyPropertySheetPage
ImageList_ReplaceIcon

user32

GetCursorPos
CreateIconIndirect
IsIconic
DefWindowProcA
CallNextHookEx
ShowWindow
ExitWindowsEx
RegisterClassExA
SendMessageA
SetActiveWindow
PostQuitMessage
InvalidateRgn
DispatchMessageA
SetTimer
GetActiveWindow
DeleteMenu
ChildWindowFromPoint
CreateWindowExA
GetIconInfo
DestroyWindow
SetParent
GetMessageA
GetAsyncKeyState
TranslateMessage
UpdateWindow
GetMenu
SetCursor
GetDesktopWindow

ole32

CLSIDFromString
CoCreateGuid
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity

gdi32

PatBlt
CreateRectRgn
CreateCompatibleDC

mpr

WNetCloseEnum

ntdll

wcscspn
towupper

msvcrt

fwrite
swscanf
memmove
_c_exit
_controlfp
_wcmdln
realloc
_tzset
wcscmp
_fdopen
fclose
_except_handler3
exit
free
_vsnwprintf
wcslen
_local_unwind2
_onexit
wprintf
_exit
wcsncmp
malloc
localtime
__set_app_type
_wtoi
_open_osfhandle
_adjust_fdiv
wcsstr
__setusermatherr
_mbslen
_wcsicmp
__dllonexit
__p__commode

shell32

SHGetSpecialFolderLocation

kernel32

BackupWrite
OpenMutexA
GetProcessHeap
CloseHandle
QueryPerformanceCounter
Sleep
ReadFile
TerminateThread
ReleaseMutex
FindVolumeMountPointClose
LeaveCriticalSection
SetUnhandledExceptionFilter
GetVersion
GetTapePosition
GetSystemTime
LoadResource
GetFileSize
CreateMutexA
VirtualAlloc
GetFileInformationByHandle
PrepareTape
GetSystemTimeAsFileTime
GetExitCodeThread
GetLastError
GetCurrentProcessId
WriteTapemark
SetTapeParameters
HeapQueryInformation

Sections

.text
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 706KB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2d6f7cb1db6f9fc81eff37c1be5c5a6

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

syssetup

advapi32

comctl32

user32

ole32

gdi32

mpr

ntdll

msvcrt

shell32

kernel32

Sections

.text Size: 340KB - Virtual size: 340KB

.data Size: 134KB - Virtual size: 134KB

.rsrc Size: 706KB - Virtual size: 3.8MB

.text
Size: 340KB - Virtual size: 340KB

.data
Size: 134KB - Virtual size: 134KB

.rsrc
Size: 706KB - Virtual size: 3.8MB