OF20q9XmKQGOJzZs3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

OF20q9XmKQGOJzZs3.exe
Size

11.6MB
MD5

f84e4df1f4930214b45d0700121708ff
SHA1

b90bdfd0e1898da750389d0ad594a68329300ff1
SHA256

116209cdad63b0f032f9e9d331641941bf7ef4bf04b589f3caabf8fa9a74506c
SHA512

1454c0478ac4357eeb69657f07b2ba15e5f5082dad5cd90e957cc7db160549716ae24774c14e20abb20b95965cbe1c69bb9e33890c3f58755bf38dd89480eb46
SSDEEP

196608:mFP4KCYpB8+TahCj1yl03CBJnZFkeqKHJdqHlIJ9s7RogGWdBH2gdoDLqxBBO:m54K7D8+TaS1yl0wZFm0dqFIJu7uBW7Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OF20q9XmKQGOJzZs3.exe

Files

OF20q9XmKQGOJzZs3.exe
.exe windows:6 windows x64 arch:x64

73a12b0cf0a49503349df1741b0ba455

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameA

user32

FindWindowA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-filesystem-l1-1-0

rename

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.4he
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.\co
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.KTs
Size: 11.6MB - Virtual size: 11.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73a12b0cf0a49503349df1741b0ba455

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 10KB

.rdata Size: - Virtual size: 6KB

.data Size: - Virtual size: 8.0MB

.pdata Size: - Virtual size: 576B

.4he Size: - Virtual size: 2.2MB

.\co Size: 512B - Virtual size: 272B

.KTs Size: 11.6MB - Virtual size: 11.6MB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 224B

.text
Size: - Virtual size: 10KB

.rdata
Size: - Virtual size: 6KB

.data
Size: - Virtual size: 8.0MB

.pdata
Size: - Virtual size: 576B

.4he
Size: - Virtual size: 2.2MB

.\co
Size: 512B - Virtual size: 272B

.KTs
Size: 11.6MB - Virtual size: 11.6MB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 224B