5c2a3501f7805e5777cd6cbd450e9e22

Sharing

Copy URL Twitter E-mail

General

Target

5c2a3501f7805e5777cd6cbd450e9e22
Size

2.0MB
MD5

5c2a3501f7805e5777cd6cbd450e9e22
SHA1

8b328d20a001be38557f1fec65adb6a43336fefa
SHA256

e26aea260dfcec2dc256c63cc9b8a6f3461e8abb3a0a606ac75e35266985c071
SHA512

a02fdcd8d22b07ff9e729bd15d7395ed74ad8a67c0cc437aaf79bb6971b41f4ccd34ea5ee2dbc0d8f409d5f34957a4817860c2af34c48b578d2bbee46030b838
SSDEEP

49152:QX3zYT6UAoAnhgrHwU36gc1LsLTQcjyeVS0uwb:WjYTVA1OwUKnAUDJwb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c2a3501f7805e5777cd6cbd450e9e22

Files

5c2a3501f7805e5777cd6cbd450e9e22
.exe windows:5 windows x86 arch:x86

357990f33d6e0c05281b756448fa2619

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

tree_peek_ndr
char_from_ndr
char_array_from_ndr
UuidCompare
RpcSsGetContextBinding
RpcSsEnableAllocate
RpcSmClientFree
RpcServerUseProtseqIfA
CStdStubBuffer_Disconnect
RpcServerUseProtseqEpExA
RpcNetworkInqProtseqsA
MIDL_wchar_strcpy
DceErrorInqTextA
CStdStubBuffer_QueryInterface

ntdll

RtlSplay
RtlNtStatusToDosError
RtlSetInformationAcl
RtlUnwind
RtlpWaitForCriticalSection
ZwDelayExecution
ZwExtendSection
NtSetThreadExecutionState
NtMapUserPhysicalPagesScatter
DbgUiConnectToDbg
NtStartProfile

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerQueryValueA

crtdll

wcstombs
setbuf
iswdigit
iswalnum
_ltow
_j0
_ismbcprint
_chsize
_ecvt
_exit
_fdopen
_finite
_getdrive

userenv

DestroyEnvironmentBlock
FreeGPOListW
RegisterGPNotification
LeaveCriticalPolicySection
GetProfilesDirectoryW
GetAppliedGPOListW
EnterCriticalPolicySection

kernel32

lstrcpynA
WriteProcessMemory
WritePrivateProfileStructW
WritePrivateProfileSectionW
VirtualFree
VirtualAlloc
VerLanguageNameW
VerLanguageNameA
UnregisterWaitEx
SetVolumeMountPointA
SetLastError
SetEnvironmentVariableA
OpenMutexA
MoveFileW
HeapAlloc
Heap32ListNext
GlobalUnWire
GlobalDeleteAtom
GetWindowsDirectoryW
GetUserDefaultUILanguage
GetTimeZoneInformation
GetSystemTime
GetPrivateProfileStringA
GetNumberFormatA
GetCommandLineA
GetBinaryTypeW
FindVolumeMountPointClose
FindNextVolumeMountPointA
FindFirstVolumeW
ExitProcess
CreateFileMappingW
CreateDirectoryW
BuildCommDCBA

Exports

Exports

GpYqcJd
Oehgi
ahorrt
bxqshixs
doeJu
gHzngWkd
hmvkbld
hrRotpa
jihmOc
kugux
nCvUcgns
qkyssmmv
qmuxfu
qohmp
vbkbqmPm

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 486KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

357990f33d6e0c05281b756448fa2619

Headers

File Characteristics

Imports

rpcrt4

ntdll

version

crtdll

userenv

kernel32

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.data Size: 486KB - Virtual size: 1.1MB

.rsrc Size: 26KB - Virtual size: 26KB

.text
Size: 34KB - Virtual size: 33KB

.data
Size: 486KB - Virtual size: 1.1MB

.rsrc
Size: 26KB - Virtual size: 26KB