4913afcbfca5dfe5ccca152439c6a614

Sharing

Copy URL Twitter E-mail

General

Target

4913afcbfca5dfe5ccca152439c6a614
Size

147KB
MD5

4913afcbfca5dfe5ccca152439c6a614
SHA1

3fbaae15c37855f924620b8c690f620f2fe52542
SHA256

b310ea348375b56876663e5af58a462b438b1b3676399cb295d4998a8b3d8302
SHA512

1a2294e0b3864afe40df824f5f5d87d9762b60fc3171d5ad4e095b04730105fd19fb8937297f3787f25004ca5afb19b67cd2f4d92e9384cdc8a9a2c2baeff565
SSDEEP

3072:7zi9eRnypVuROgtcbNqCwbs7g7vIIIRk2IaB1oRo2ovoKA8Drowvogq+2fFXT:7zi9bpVuROgtcb8dInRk2IaB1oRhwdAf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4913afcbfca5dfe5ccca152439c6a614

Files

4913afcbfca5dfe5ccca152439c6a614
.exe windows:4 windows x86 arch:x86

18643204384b534c58555f5ee41fee80

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetModuleFileNameA
Sleep
lstrcpyA
lstrlenA
lstrcatA
CopyFileA
CreateDirectoryA
ExitThread
CreateThread
GetTempPathA
DeleteFileA
CreateFileA
GetFileSize
ReadFile
CloseHandle
SetFilePointer
LoadLibraryA
MultiByteToWideChar
GetProcAddress
TransactNamedPipe
TerminateThread
CreateFileMappingA
MapViewOfFile
GetWindowsDirectoryA
UnmapViewOfFile
GetSystemDirectoryA
FindResourceA
LoadResource
SizeofResource
LockResource
WriteFile
GetModuleHandleA
ExitProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetVersionExA
WinExec
CreateMutexA
GetLastError
GetSystemTime
lstrcmpA
lstrcmpiA
GetProcessHeap
HeapAlloc
lstrcpynA
GlobalFree
InterlockedIncrement
InterlockedDecrement
HeapFree
GetTempFileNameA
GlobalAlloc
FindFirstFileA
FindNextFileA
FindClose
GetEnvironmentVariableA
GetDriveTypeA
GetCurrentThread
SetThreadPriority
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeZoneInformation
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
SetCurrentDirectoryA
GetFullPathNameA
OpenProcess
TerminateProcess
GetStartupInfoA

user32

wsprintfA
CharLowerA
EnumWindows
GetClassNameA
SendMessageA
EnumChildWindows
FindWindowA
MessageBoxA
CharUpperA
CharUpperBuffA
wvsprintfA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA

shell32

ShellExecuteA

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileA

odbc32

ord24
ord75
ord31
ord41
ord11
ord9

msvcrt

strlen
rand
fopen
fclose
memset
sprintf
srand
sscanf
strcmp
fread
feof
strcpy
strcat
_strdup
strstr
strncpy
strncat
free
strncmp
fseek
memcpy
malloc
memcmp
_splitpath
_snprintf
time
strrchr
strtok
calloc
_stricmp
_makepath
tmpnam
strchr
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_controlfp

ws2_32

closesocket
socket
getsockname
setsockopt
ioctlsocket
htons
bind
listen
select
__WSAFDIsSet
accept
send
recv
inet_addr
connect
recvfrom
inet_ntoa
sendto
gethostbyname
ntohs
gethostname
WSAGetLastError
htonl
shutdown
WSAStartup
WSACleanup
WSASocketA

mpr

WNetAddConnection2A

rpcrt4

UuidFromStringA
UuidToStringA

Sections

.text
Size: 140KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18643204384b534c58555f5ee41fee80

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wininet

urlmon

odbc32

msvcrt

ws2_32

mpr

rpcrt4

Sections

.text Size: 140KB - Virtual size: 150KB

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 140KB - Virtual size: 150KB

.rsrc
Size: 7KB - Virtual size: 6KB