4f9a4a12277374f3c44eb622bd9e3d9e

Sharing

Copy URL Twitter E-mail

General

Target

4f9a4a12277374f3c44eb622bd9e3d9e
Size

425KB
MD5

4f9a4a12277374f3c44eb622bd9e3d9e
SHA1

ee44d3e79243bbe90e91ea0fe63c85223eca793d
SHA256

be0a1d2250dc82d85abac56c315ff59bc57b107fa3916b6f4b06f4fcc1b01b70
SHA512

aceca04222e22c9cab293a22dc3b4d294e6935fe609a7ba8023f8b0b8af1b7e221cea9d9a4cdc2d8b6bfb2d65e0e203ad4f2edc356d35b94e536a38568414212
SSDEEP

6144:EQvvhPhb/jG4jrvwt5fE29SuE7vpsASiPxVgFgsQU15bjzuDkR:/ZPFjTYt5E291E7xb9VfULb2Dk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f9a4a12277374f3c44eb622bd9e3d9e

Files

4f9a4a12277374f3c44eb622bd9e3d9e
.exe windows:6 windows x86 arch:x86

bb5c1c515db4e08581f0633b5a33d2ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
DecodePointer
SetEndOfFile
HeapReAlloc
HeapSize
WriteConsoleW
CreateFileW
GetProcessHeap
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetFileAttributesExW
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
GetStringTypeW
MoveFileExW
DeleteFileW
SetFilePointerEx
ReadConsoleW
ReadFile
GetConsoleCP
FlushFileBuffers
CloseHandle
GetFileType
LCMapStringW
CompareStringW
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
WideCharToMultiByte
GetCommandLineA
GetCommandLineW
GetACP
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
HeapFree
RaiseException

ws2_32

htonl
getservbyport
WSAProviderConfigChange
WSAAccept

mswsock

NPLoadNameSpaces
GetTypeByNameW
TransmitFile
WSARecvEx
GetServiceA
s_perror

rtm

MgmRegisterMProtocol
RtmRegisterClient
MgmGetMfe
RtmCloseEnumerationHandle
RtmBlockDeleteRoutes
RtmDeregisterClient

msi

ord124
ord44
ord72
ord110
ord38
ord24
ord77

pdh

PdhEnumObjectsW
PdhGetDefaultPerfCounterA
PdhValidatePathW
PdhValidatePathA
PdhGetDataSourceTimeRangeW
PdhGetDefaultPerfObjectA

mpr

WNetAddConnection2W
WNetGetLastErrorW
WNetAddConnection3A
WNetDisconnectDialog
WNetOpenEnumW
WNetGetLastErrorA
WNetUseConnectionW
WNetConnectionDialog1A

winmm

joyGetDevCapsW
mmioWrite
waveInGetDevCapsA
waveInGetErrorTextA
waveInGetID
midiInGetID
mixerGetDevCapsW

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb5c1c515db4e08581f0633b5a33d2ba

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

mswsock

rtm

msi

pdh

mpr

winmm

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 28KB - Virtual size: 30KB

.gfids Size: 512B - Virtual size: 176B

.rsrc Size: 87KB - Virtual size: 86KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 28KB - Virtual size: 30KB

.gfids
Size: 512B - Virtual size: 176B

.rsrc
Size: 87KB - Virtual size: 86KB

.reloc
Size: 5KB - Virtual size: 4KB