649d54bc9eef5a60a4b9d8b889fee139

General

Target

649d54bc9eef5a60a4b9d8b889fee139
Size

49KB
MD5

649d54bc9eef5a60a4b9d8b889fee139
SHA1

cc91bc68522fa8912825e71abeb2ddf9ffce1220
SHA256

f9f2ac8167051aa7d2c38044cbbbd5542dd4901593aa0dcfe1a6ea9a92850da7
SHA512

499e37d63048ed39d125a482918a6d32a3691aaf75c44fce6a993dc4751665a731d2c592be55c3b641bd289cf602cd8070fee1c6d2ac56dfaf557eded0f9241d
SSDEEP

768:FnscdiuN4igu6IAIQTsgdepZj2kzhM/6RDmMlwp0yMxt:pi/wuvYpAkt3RDmsdxt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
649d54bc9eef5a60a4b9d8b889fee139

Files

649d54bc9eef5a60a4b9d8b889fee139
.exe windows:4 windows x86 arch:x86

df0fe717180c53ec7a29f1890a62313a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
Sleep
CloseHandle
TerminateProcess
WriteFile
ReadFile
PeekNamedPipe
CreateProcessA
GetSystemDirectoryA
CreatePipe
GetComputerNameA
GlobalFree
GetCurrentProcess
GetEnvironmentVariableA
GetModuleFileNameA
CopyFileA
GetLastError
GetLocalTime
LCMapStringA
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
CreateFileA
FlushFileBuffers
SetStdHandle
HeapReAlloc
LCMapStringW
VirtualAlloc
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

winhttp

WinHttpSetOption
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpWriteData
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpQueryOption
WinHttpGetIEProxyConfigForCurrentUser

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df0fe717180c53ec7a29f1890a62313a

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

winhttp

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 11KB - Virtual size: 23KB

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 11KB - Virtual size: 23KB