6360ab817ad4530ca5791deeb3f47a63

Sharing

Copy URL Twitter E-mail

General

Target

6360ab817ad4530ca5791deeb3f47a63
Size

160KB
MD5

6360ab817ad4530ca5791deeb3f47a63
SHA1

8f5fe2c987678db1771d000f87e8512a2b92bdaf
SHA256

cb6731b791386ab0bb0dcaf62d7d43efa93ec8ea1803d987a20bedcdd60518b6
SHA512

bdbbda930554a803017ef37e8a5ce2ad232538f98006d083b7989823543810800a6291c72f507a9a665daa683bb3ac8f78f8a8d96d018b481781a2b0fd73ccc8
SSDEEP

3072:+SvOALKDT5MtyX1ccjgs+0yqWFiX/rXD5aS1i/NU8bOMYcYYcmy5E+:PAMtyXuseCrXUMi/NjO5A+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6360ab817ad4530ca5791deeb3f47a63

Files

6360ab817ad4530ca5791deeb3f47a63
.exe windows:5 windows x86 arch:x86

d42f9fed4fa4891d94663b6449dde2e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
WaitForMultipleObjects
GetShortPathNameA
GetEnvironmentVariableA
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetCurrentProcess
WritePrivateProfileStringA
LocalAlloc
LocalFree
GetModuleFileNameA
LoadLibraryExA
FreeLibrary
FindResourceA
LoadResource
LockResource
SizeofResource
lstrcpyA
lstrcatA
FindFirstFileExA
SetFileAttributesA
DeleteFileA
FindNextFileA
FindClose
MultiByteToWideChar
lstrlenA
GetPrivateProfileStringA
lstrcmpiA
ReadFile
SetFilePointer
CreateFileA
HeapSize
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LoadLibraryA
WriteFile
CloseHandle
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCommandLineA
GetStartupInfoA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount

user32

CharLowerA
PeekMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
GetDesktopWindow

advapi32

FreeSid
RegDeleteValueA
RegSetKeySecurity
RegQueryValueExA
RegCreateKeyA
RegSetValueA
RegOpenKeyExA
RegSetValueExA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
AllocateAndInitializeSid
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityA
RegCreateKeyExA
RegCloseKey

shell32

ShellExecuteExA
SHChangeNotify
ShellExecuteA
SHGetSpecialFolderPathA

ole32

CoCreateInstance
CoInitialize
CoUninitialize

shlwapi

StrStrA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d42f9fed4fa4891d94663b6449dde2e1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

iphlpapi

Sections

.text Size: 97KB - Virtual size: 96KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 34KB - Virtual size: 33KB

.text
Size: 97KB - Virtual size: 96KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 34KB - Virtual size: 33KB