639c5a4f8e3368d55607a48c43973663

Sharing

Copy URL Twitter E-mail

General

Target

639c5a4f8e3368d55607a48c43973663
Size

1.2MB
MD5

639c5a4f8e3368d55607a48c43973663
SHA1

3db0d9fe3e184c69e2679b40a215d27024603150
SHA256

6ea77395d813a380712e4164d5c7d761525d4e63bae61c2442913df4aec9348c
SHA512

85b7a7c939443528bf8e11ce09b23396b69c9a6be14812ab1e6bd1bc0fdb35fbe34881af6e781bb9b5ccdab31e7d1db314c47135320e24c7e0fb0d4208fe65ce
SSDEEP

24576:khq5JRXsWUuXoXTHmHl0XsG5ewzCrYjc1NmKmiBCAFDXzPKecnChWJWLLEALf14:khq5JRXsWUuXoXTHmHl0XsG5elm7EC2p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
639c5a4f8e3368d55607a48c43973663

Files

639c5a4f8e3368d55607a48c43973663
.exe windows:6 windows x86 arch:x86

b438e1505d19925887bb8752e6d038b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
GetCurrentProcess
TerminateProcess
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
GetModuleHandleExW
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
GetCommandLineW
HeapValidate
GetSystemInfo
CloseHandle
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetCurrentThread
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
HeapReAlloc
HeapSize
HeapQueryInformation
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
CreateFileW
DecodePointer

Sections

.text
Size: 503KB - Virtual size: 502KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.msvcjmc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 567KB - Virtual size: 566KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b438e1505d19925887bb8752e6d038b2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 503KB - Virtual size: 502KB

.rdata Size: 123KB - Virtual size: 123KB

.data Size: 3KB - Virtual size: 7KB

.msvcjmc Size: 512B - Virtual size: 16B

.vmp0 Size: 567KB - Virtual size: 566KB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: 503KB - Virtual size: 502KB

.rdata
Size: 123KB - Virtual size: 123KB

.data
Size: 3KB - Virtual size: 7KB

.msvcjmc
Size: 512B - Virtual size: 16B

.vmp0
Size: 567KB - Virtual size: 566KB

.rsrc
Size: 512B - Virtual size: 469B