4b2ec198a9e53fc30808d44280c4312a

Sharing

Copy URL Twitter E-mail

General

Target

4b2ec198a9e53fc30808d44280c4312a
Size

168KB
MD5

4b2ec198a9e53fc30808d44280c4312a
SHA1

02cb955c6d5b60a516686ff03695ba0e8c78019c
SHA256

ff8f96e99f2fda8c8fe18d7882e192c62b6c27737bb2f08bf67e67876e1ac0ba
SHA512

0cd1299f5c9b06938b968abe640d94a8d610780ba1bb66c76298547eb946db9d7f47f7d14814525c616a4369a9f497c6d067337b601b2b87673102e6fe4c89a1
SSDEEP

3072:cmD+1/nHF/5qWysY0EX0KHNg4ZQGqORAGtwyjm+uTlVBdPFgw6Dct:ZMnHF/5q7yA06NZ7RAh7LlVqB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b2ec198a9e53fc30808d44280c4312a

Files

4b2ec198a9e53fc30808d44280c4312a
.exe windows:4 windows x86 arch:x86

b9702630a01e0b52533f00a9eadd7661

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

GetUserNameW
RegCloseKey
RegOpenKeyExA
RegSetValueExA

kernel32

CloseHandle
CopyFileA
CreateFileA
CreateMutexA
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
GetACP
GetCPInfo
GetCommandLineA
GetCurrentThreadId
GetEnvironmentStrings
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
HeapAlloc
HeapFree
InterlockedExchange
LoadLibraryA
LoadResource
LockResource
MultiByteToWideChar
OutputDebugStringA
RaiseException
ReleaseMutex
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SizeofResource
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteFile

netapi32

NetApiBufferFree
NetUserGetInfo

shell32

ShellExecuteA

user32

EnumThreadWindows
MessageBoxA
wsprintfA

wininet

FtpPutFileA
InternetCloseHandle
InternetConnectA
InternetOpenA

Exports

Exports

__GetExceptDLLinfo
___CPPdebugHook

Sections

.text
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 95KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9702630a01e0b52533f00a9eadd7661

Headers

File Characteristics

Imports

advapi32

kernel32

netapi32

shell32

user32

wininet

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 52KB

.data Size: 15KB - Virtual size: 20KB

.tls Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.idata Size: 2KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 95KB - Virtual size: 96KB

.reloc Size: 3KB - Virtual size: 4KB

.text
Size: 49KB - Virtual size: 52KB

.data
Size: 15KB - Virtual size: 20KB

.tls
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.idata
Size: 2KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 95KB - Virtual size: 96KB

.reloc
Size: 3KB - Virtual size: 4KB