555641ec18be5478c3a2b02dff4120b2

Sharing

Copy URL

Twitter E-mail

General

Target

555641ec18be5478c3a2b02dff4120b2
Size

85KB
MD5

555641ec18be5478c3a2b02dff4120b2
SHA1

60f9b3f8b90291224390e2ab0aae1c2ba8efebf8
SHA256

d588901ffbebda78a3465f0cb8c4ce6e8df67dd19175471328178d199eb7412c
SHA512

6a57ae33ee60f9ad2c74b844977223466be9cd78893484e5f4fe5b77ced4233bc53731d2e042ec1fb3cfa7922e9dce655bf33eac23379e203e34ab52376dcc1c
SSDEEP

1536:4MeKug3XFrZnvUVY04YcPqTNvb0bWO6X9MvfTXIPgYAeHqh:VFHv1nIND0aO73

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
555641ec18be5478c3a2b02dff4120b2

Files

555641ec18be5478c3a2b02dff4120b2
.exe windows:5 windows x86 arch:x86

e02b66b9746e52269da88e6cecd7db06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetDeviceDriverFileNameA
EnumProcessModules
EmptyWorkingSet
EnumPageFilesW
QueryWorkingSet
EnumPageFilesA
GetWsChanges
InitializeProcessForWsWatch
GetDeviceDriverBaseNameA
GetPerformanceInfo
GetModuleFileNameExA
GetDeviceDriverFileNameW

wininet

FtpPutFileEx
LoadUrlCacheContent
InternetSetDialState
ParseX509EncodedCertificateForListBoxEntry
InternetShowSecurityInfoByURLW
InternetGetCookieA
InternetGetCookieExA
FtpOpenFileW
FindNextUrlCacheEntryExA
CreateUrlCacheEntryA
InternetGoOnlineW
InternetReadFileExW
InternetGetConnectedState
DeleteUrlCacheEntry
FtpRemoveDirectoryW
InternetUnlockRequestFile
RetrieveUrlCacheEntryStreamA

msdart

?ReadOrWriteLock@CSpinLock@@QAE_NXZ
?TryReadLock@CCritSec@@QAE_NXZ
?IsWriteLocked@CReaderWriterLock3@@QBE_NXZ
?_Initialize@CLKRLinearHashTable@@AAE?AW4LK_RETCODE@@P6G?BKPBX@ZP6GKK@ZP6G_NKK@ZP6GX0H@ZPBDNK@Z
?sm_pfnTryEnterCriticalSection@CCriticalSection@@0P6GHPAU_RTL_CRITICAL_SECTION@@@ZA
?ReadOrWriteLock@CCritSec@@QAE_NXZ
?sm_dblDfltSpinAdjFctr@CCritSec@@1NA
?FindKey@CLKRLinearHashTable@@QBE?AW4LK_RETCODE@@KPAPBX@Z
?WriteUnlock@CCritSec@@QAEXXZ
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SGNXZ
?WriteUnlock@CSpinLock@@QAEXXZ
?SetSpinCount@CCritSec@@QAE_NG@Z
?GetDefaultSpinAdjustmentFactor@CFakeLock@@SGNXZ
MPCSInitialize
?_DeleteIf@CLKRLinearHashTable@@AAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1AAW42@@Z
?NumSubTables@CLKRLinearHashTable@@QBEHXZ
?SetSpinCount@CSmallSpinLock@@QAE_NG@Z

kernel32

SetComPlusPackageInstallStatus
SetVolumeMountPointA
GetLocalTime
GetConsoleAliasW
EnumerateLocalComputerNamesA
GetCompressedFileSizeW
LoadLibraryA
lstrcatA
FreeLibraryAndExitThread
SetCalendarInfoA
VirtualAlloc
GetProcessId
SetVolumeLabelA
InvalidateConsoleDIBits
FreeUserPhysicalPages

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e02b66b9746e52269da88e6cecd7db06

Headers

DLL Characteristics

File Characteristics

Imports

psapi

wininet

msdart

kernel32

Sections

.text Size: 44KB - Virtual size: 44KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 17KB - Virtual size: 20KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 512B - Virtual size: 340B

.text
Size: 44KB - Virtual size: 44KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 340B