51f951b980483c1fbc50d5089a0046f1

Sharing

Copy URL Twitter E-mail

General

Target

51f951b980483c1fbc50d5089a0046f1
Size

120KB
MD5

51f951b980483c1fbc50d5089a0046f1
SHA1

fbf2d1e8312ee48fd69995ff54527182ba6f2959
SHA256

26115879cb760e42ca4d111f32887bf83ea488370867af9aa9f3dfde91072545
SHA512

0d602beb73101ec851517428842ead7347c17f9a41feacc909d455bc07ca28489b78bf156b5fab6dbd9e853a0eb704ed70ac862de2b6e9efdb685f8c6df9f8ef
SSDEEP

3072:bPYJGj3Mb6lF4ibnwTXw8zyIKll8naEBQ:b8EMWhnwTg8zn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51f951b980483c1fbc50d5089a0046f1

Files

51f951b980483c1fbc50d5089a0046f1
.exe windows:4 windows x86 arch:x86

454ea035e37695d9830b1bf53583ad9c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileMappingW
GetFileSize
CreateFileW
DeleteFileW
WriteFile
ExpandEnvironmentStringsW
LoadLibraryA
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
GetOEMCP
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
GetEnvironmentVariableW
TerminateProcess
lstrcatW
lstrcpynW
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
MultiByteToWideChar
WaitForSingleObject
GetSystemInfo
GetVolumeInformationW
GetCommandLineW
CreateEventW
OpenEventW
SetEvent
CloseHandle
GetModuleFileNameW
GetLastError
Sleep
LocalAlloc
GetACP
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
SetEnvironmentVariableA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
LocalFree
lstrlenW
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcessId
GetFileAttributesW
LCMapStringW
LCMapStringA
HeapSize
GetCurrentProcess
HeapReAlloc
HeapAlloc
RaiseException
HeapFree
ExitProcess
GetVersion
GetCommandLineA
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetModuleHandleA
GetStartupInfoA

user32

wsprintfW

advapi32

RegCreateKeyW
RegQueryValueExW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
DeleteService
CreateServiceW
ChangeServiceConfig2W
StartServiceW
StartServiceCtrlDispatcherW
RegOpenKeyExW
RegisterServiceCtrlHandlerExW
SetServiceStatus
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
QueryServiceStatus
RegDeleteValueW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW

shlwapi

UrlGetPartW
StrStrIW

dnsapi

DnsFree

wininet

InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
InternetConnectW
InternetOpenW
HttpQueryInfoW
InternetReadFile
InternetCrackUrlW
InternetCloseHandle
InternetSetOptionW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

454ea035e37695d9830b1bf53583ad9c

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

dnsapi

wininet

version

urlmon

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 20KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 856B

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 20KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 856B