4b3ab194b7f8a29be941b92da74ce66c

Sharing

Copy URL Twitter E-mail

General

Target

4b3ab194b7f8a29be941b92da74ce66c
Size

2.4MB
MD5

4b3ab194b7f8a29be941b92da74ce66c
SHA1

65e0ed781e010a0ca70ef5bc2c81d6fee4dcd0ca
SHA256

19c264a82ce241cd576a9ece68d78a9c19ff43239c1a447eb2a334ef78a32c34
SHA512

3ef287f725339aa87bb8a6d2bd924b1ae6cd4bd73ed020986e548f0d2a1584613bf0b4f09de5f569b75b50b1cc5449323bb263f4058d487d65b97bb4dc161ace
SSDEEP

49152:B1DuwhnINC6HFl7eIwxU54asTFmp/lj7ZCVAHghZiySqPnHqDk:Bz+vux66ApxZgv+gH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b3ab194b7f8a29be941b92da74ce66c

Files

4b3ab194b7f8a29be941b92da74ce66c
.exe windows:6 windows x64 arch:x64

4e10c6d5896e4745dd65039cd954e4c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crypt32

CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext

kernel32

CloseHandle
QueueUserAPC
GetProcAddress
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateProcessA
TlsFree
FormatMessageA
CreateIoCompletionPort
GetComputerNameA
GetStdHandle
GetFileType
TerminateThread
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
RtlUnwind
FindFirstFileW
WriteConsoleW
HeapSize
GetProcessHeap
SetEvent
GetLastError
FormatMessageW
Sleep
MultiByteToWideChar
CreateEventW
PostQueuedCompletionStatus
GetModuleHandleA
WaitForSingleObject
PeekNamedPipe
GetQueuedCompletionStatus
CreatePipe
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
CreateWaitableTimerW
EnterCriticalSection
SetLastError
TlsSetValue
SetWaitableTimer
ReadFile
TlsAlloc
WriteFile
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
GetConsoleOutputCP
FlushFileBuffers
GetTimeZoneInformation
HeapAlloc
GetFileSizeEx
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
FileTimeToSystemTime
RtlUnwindEx
GetStartupInfoW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
RtlPcToFileHeader
RaiseException
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
LCMapStringEx
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent

user32

SetCursorPos
SendInput
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

CryptGetProvParam
RegSetValueExW
GetUserNameA
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptEnumProvidersA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
RegOpenKeyW
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource

ole32

CoCreateInstance
CoUninitialize
CoInitialize

ws2_32

gethostbyname
select
ntohl
shutdown
listen
WSASetLastError
WSASocketW
inet_pton
getaddrinfo
WSAStartup
getpeername
getsockname
send
socket
closesocket
connect
WSAAddressToStringW
__WSAFDIsSet
gethostname
WSARecv
recv
getsockopt
htonl
htons
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError
WSAIoctl
bind
accept
WSACleanup
WSASend
ntohs
inet_ntoa

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 606KB - Virtual size: 606KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 82KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e10c6d5896e4745dd65039cd954e4c5

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

kernel32

user32

advapi32

ole32

ws2_32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 606KB - Virtual size: 606KB

.data Size: 82KB - Virtual size: 103KB

.pdata Size: 89KB - Virtual size: 88KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 606KB - Virtual size: 606KB

.data
Size: 82KB - Virtual size: 103KB

.pdata
Size: 89KB - Virtual size: 88KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 24KB - Virtual size: 24KB