561f904f4152d6a2225d0978d2e901e9

Sharing

Copy URL

Twitter E-mail

General

Target

561f904f4152d6a2225d0978d2e901e9
Size

1.1MB
MD5

561f904f4152d6a2225d0978d2e901e9
SHA1

2ed3d73dc56f6514c0ea49b779c88891a522d844
SHA256

c64fdbd9aad1f96684e3725ce8eeafab663276da18ba4a5ebff6753cf537b5a1
SHA512

c8d6e3e1a5d8320c5353bfd7034bdbe4608aa556d2735fb002d73f35d1420b9d4eeca98f4a2df0456a661b5a800eae51741f6fd3a09e70bf29d95e4f0f28094b
SSDEEP

24576:uVZE+OucGT1bJPj7NTH46ov2T5P45cUU7oHx52p7:2xxhNP1l9P4y37u5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
561f904f4152d6a2225d0978d2e901e9

Files

561f904f4152d6a2225d0978d2e901e9
.exe windows:5 windows x86 arch:x86

8cef0730ec46b3503980d620ebd7fcea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

mpr

WNetCloseEnum

advapi32

GetAce
EqualSid
CloseEncryptedFileRaw
GetSecurityDescriptorDacl
FreeSid
InitializeAcl
RegOpenKeyExA
InitializeSecurityDescriptor
WriteEncryptedFileRaw
GetTokenInformation

kernel32

SystemTimeToFileTime
QueryPerformanceCounter
CloseHandle
UnhandledExceptionFilter
GetExitCodeThread
GetLastError
GetProcessHeap
LockFile
SetEvent
GlobalFree
ReleaseSemaphore
TerminateThread
DeviceIoControl
EraseTape
CreateMutexA
ReleaseMutex
VirtualAllocEx
CreateNamedPipeA
GetTimeZoneInformation
GetTickCount
OpenMutexA
GetTapeStatus
GetCurrentDirectoryA
GetCurrentProcessId
SystemTimeToTzSpecificLocalTime

syssetup

AsrFreeContext
AsrRestorePlugPlayRegistryData

shell32

SHGetSpecialFolderLocation

setupapi

SetupFindNextLine
SetupCloseInfFile

ntdll

iswctype
isdigit

gdi32

CreateRectRgn
GetMapMode
CreateCompatibleBitmap
BitBlt

netapi32

NetServerEnum
NetWkstaGetInfo
NetShareGetInfo

ole32

CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoInitializeEx

comctl32

ImageList_GetIcon
ImageList_AddMasked

user32

CreateIconIndirect
CopyRect
GetNextDlgGroupItem
GetCursorPos
SendMessageA
GetClientRect
GetDC
RemoveMenu
UnhookWindowsHookEx
ShowWindow
UpdateWindow
GetMessageA
CreateWindowExA
DestroyWindow
RegisterClassExA
DispatchMessageA
TranslateMessage
GetCapture
GetSubMenu
DefWindowProcA

msvcrt

_initterm
wcsncpy
localtime
_mbscpy
_wtoi
_wcsrev
_controlfp
_c_exit
time
_wfopen
ftell
_errno
exit
wprintf
_local_unwind2
_except_handler3
isalpha
wcspbrk

Sections

.text
Size: 620KB - Virtual size: 620KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 297KB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8cef0730ec46b3503980d620ebd7fcea

Headers

DLL Characteristics

File Characteristics

Imports

mpr

advapi32

kernel32

syssetup

shell32

setupapi

ntdll

gdi32

netapi32

ole32

comctl32

user32

msvcrt

Sections

.text Size: 620KB - Virtual size: 620KB

.data Size: 257KB - Virtual size: 257KB

.rsrc Size: 297KB - Virtual size: 3.3MB

.text
Size: 620KB - Virtual size: 620KB

.data
Size: 257KB - Virtual size: 257KB

.rsrc
Size: 297KB - Virtual size: 3.3MB