63891193027ba9a745513f5d8d076776

Sharing

Copy URL Twitter E-mail

General

Target

63891193027ba9a745513f5d8d076776
Size

246KB
MD5

63891193027ba9a745513f5d8d076776
SHA1

ad177d1382fd503d5ce3d43862207cf2525afaf3
SHA256

41f6e4ac102c3a758d86c44686321b29cd8f8f3698a3bf71fd69b1fc72bd48c3
SHA512

9d4024997da850472119e984474f77b98d31debd328c620a3b60e5861615be069debbdca021b8b847835e355b2d8a805f430f2f26e51dc5bd9336b695f005d71
SSDEEP

6144:3caN3g2bxPi5pPF2NYTLPlRYQW/pnxfqXoh2q0o391z:3NJBNPi5pPU4LXY1Yoiuh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63891193027ba9a745513f5d8d076776

Files

63891193027ba9a745513f5d8d076776
.exe windows:6 windows x64 arch:x64

e1f2cec57812def668cd171db4a39115

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crypt32

CryptProtectData

kernel32

SetStdHandle
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateFileW
OpenProcess
WaitForSingleObject
FindClose
GetModuleFileNameW
TerminateProcess
OutputDebugStringA
GetCommandLineW
FindFirstFileW
LocalFree
ReadConsoleW
GetCommandLineA
GetOEMCP
GetACP
GetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
GetProcessHeap
FindFirstFileExW
FindNextFileW
IsValidCodePage
WriteConsoleW

user32

GetWindowThreadProcessId
EnumWindows
GetClassNameW
SendMessageW
PostMessageW

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW

shell32

CommandLineToArgvW
ShellExecuteExW

Sections

.text
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1f2cec57812def668cd171db4a39115

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

kernel32

user32

advapi32

shell32

Sections

.text Size: 142KB - Virtual size: 142KB

.rdata Size: 84KB - Virtual size: 84KB

.data Size: 4KB - Virtual size: 10KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 142KB - Virtual size: 142KB

.rdata
Size: 84KB - Virtual size: 84KB

.data
Size: 4KB - Virtual size: 10KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB