4ca36a2cc4a0a22dfb3e43d219cc6448

Sharing

Copy URL Twitter E-mail

General

Target

4ca36a2cc4a0a22dfb3e43d219cc6448
Size

171KB
MD5

4ca36a2cc4a0a22dfb3e43d219cc6448
SHA1

c123b8c3cbecccdb1e823e5494713fd073b49476
SHA256

cff05af7ee65d3cf8bf4ed5f51ebe5d2e782656b8fa534353b5c29e831c88185
SHA512

42da84c3e46ad3b0dc23e6c957e0d4814bc56473d5771a4d553f9f69cbe0a5bdaa3b85159359917873e78a0f7bdaa171a8dc2947956b0c3ffc8453ce003490f5
SSDEEP

3072:0e/E8R6WT3ru5UAbY2Xem0io04G/C/feylKYFStCefMxX+yblDKKjWK:28t3ru5UAc2XhuGK3XlKkO4llOKjW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ca36a2cc4a0a22dfb3e43d219cc6448

Files

4ca36a2cc4a0a22dfb3e43d219cc6448
.exe windows:4 windows x86 arch:x86

8a4e727b9a019f199e67138eb9bd37a2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetShortPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
lstrcmpiW
GetCommandLineW
SetErrorMode
CopyFileW
lstrcmpW
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
GetLocalTime
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
WideCharToMultiByte
MultiByteToWideChar
GetTempPathW
GetSystemInfo
GetVersionExW
ExitProcess
CreateProcessW
GetModuleHandleA
lstrcmpA
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
WaitForSingleObject
GetExitCodeThread
CreateRemoteThread
LoadLibraryW
GetProcAddress
GetCurrentProcess
lstrlenW
lstrcpynW
SetFileAttributesW
GetFileSize
CloseHandle
lstrlenA
WriteFile
ReadFile
CreateFileW
FormatMessageW
LocalAlloc
lstrcpyW
LocalFree
GetLastError
GetComputerNameW
GetStartupInfoA

user32

GetSystemMetrics
wsprintfW
IsCharAlphaW

advapi32

RegisterServiceCtrlHandlerW
LsaOpenPolicy
LsaNtStatusToWinError
LookupAccountNameW
LsaAddAccountRights
LsaClose
AllocateAndInitializeSid
LookupAccountSidW
FreeSid
StartServiceCtrlDispatcherW
SetServiceStatus
OpenSCManagerW
CreateServiceW
OpenServiceW
StartServiceW
CloseServiceHandle
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

shlwapi

StrStrW
StrRChrW

shell32

CommandLineToArgvW

netapi32

NetLocalGroupAddMembers
NetUserAdd

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
memcpy
_lrotr
_lrotl
??3@YAXPAX@Z
__CxxFrameHandler
??2@YAPAXI@Z
memset
strchr
strlen
_CxxThrowException
_except_handler3
__dllonexit
_onexit
??1type_info@@UAE@XZ

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a4e727b9a019f199e67138eb9bd37a2

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

netapi32

msvcrt

msvcp60

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 111KB - Virtual size: 110KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 111KB - Virtual size: 110KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB