64583eba146d7b96b963c1a40f2c8893

Sharing

Copy URL Twitter E-mail

General

Target

64583eba146d7b96b963c1a40f2c8893
Size

68KB
MD5

64583eba146d7b96b963c1a40f2c8893
SHA1

5517272d73542f62827d70b9616c986cf236833a
SHA256

98cc44effb578114ba99f5184d2140be7812100d0304ee00a14e3c13655eda3d
SHA512

cb42fad3cae591fd2cfc5df7af33f3a2bd674576249d934e0a51de7d3fa3bb1cdc42e65fa2a4c6aa29a980e0eb5f61304e757a4fe1a7813f1cdc5c8bffbe0f34
SSDEEP

1536:fAQahZwUpk7LWKpY+T3S8ERTyT6G+9Saoz:AgXXpxbT6G+Aaoz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64583eba146d7b96b963c1a40f2c8893

Files

64583eba146d7b96b963c1a40f2c8893
.exe windows:4 windows x86 arch:x86

562f95629d1e080909fef12076a8d63d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
GetLastError
CreateMutexA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetWindowsDirectoryA
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
GetCurrentDirectoryA
CopyFileA
SetCurrentDirectoryA
GetVersionExA
Sleep
CreateFileA
FlushFileBuffers
SetStdHandle
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapFree
ResumeThread
CreateThread
TlsSetValue
ExitThread
CloseHandle
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
WriteFile
WideCharToMultiByte
GetCurrentThreadId
TlsAlloc
SetLastError
TlsGetValue
TerminateProcess
GetCurrentProcess

user32

TranslateMessage
IsDialogMessageA
GetMessageA
CreateDialogParamA
DispatchMessageA
LoadIconA
LoadCursorA
DefDlgProcA
TrackPopupMenu
PostMessageA
RegisterClassA
PostQuitMessage
ShowWindow
SetForegroundWindow
GetCursorPos
GetSubMenu

advapi32

RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

wsock32

recv
select
send
closesocket
connect
setsockopt
socket
htons
ioctlsocket
gethostbyname
WSAStartup

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

562f95629d1e080909fef12076a8d63d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wsock32

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 52KB

.rsrc Size: 4KB - Virtual size: 864B

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 52KB

.rsrc
Size: 4KB - Virtual size: 864B