66c83a50ecbed27ab82de1c770f01ae9

Sharing

Copy URL Twitter E-mail

General

Target

66c83a50ecbed27ab82de1c770f01ae9
Size

1.7MB
MD5

66c83a50ecbed27ab82de1c770f01ae9
SHA1

6035313164d9a286328c3626bc33f36746feb015
SHA256

e41bb479777c4a2677a277b3559b960f382dc27f0b6c9a85075b795c981efcc5
SHA512

d6226e42fd1cca43729d8c5a79cad6f19ce189cd0d288fc3934e6cbcf54dd9712517db24bb615b6d1b3048ae42763ec86ce60d6ebd2ea42b573abbb4ffb99d70
SSDEEP

24576:uMMcFgENB+NSOIqTL2quNy3CtApi9Nai5Qcwb8u6lsbYTMY38Z+kKwhppZMswY0v:mcSOYNNXn2FRM/DXJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66c83a50ecbed27ab82de1c770f01ae9

Files

66c83a50ecbed27ab82de1c770f01ae9
.exe windows:4 windows x86 arch:x86

bfcc30be862e35a52b860c504ab173ea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

advapi32

RevertToSelf
LogonUserW
SystemFunction040
SystemFunction041
ImpersonateLoggedOnUser

secur32

LsaDeregisterLogonProcess
LsaFreeReturnBuffer
LsaConnectUntrusted
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage

msvcrt

wcslen
wcschr
_wcsnicmp
free
_initterm
_except_handler3
_purecall
wcstok
wcscpy
_adjust_fdiv
sprintf
_wcsicmp
malloc
wcscat
wcscmp
swscanf

netapi32

NetUserSetInfo
NetUserChangePassword

kernel32

InitializeCriticalSection
DisableThreadLibraryCalls
InterlockedIncrement
QueryPerformanceCounter
GetCurrentProcess
SetUnhandledExceptionFilter
DeleteCriticalSection
LeaveCriticalSection
DosDateTimeToFileTime
EnterCriticalSection
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToDosDateTime
GetProcAddress
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
FreeLibrary
InterlockedDecrement
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetSystemTime
FileTimeToLocalFileTime
FormatMessageW
UnhandledExceptionFilter
LoadLibraryW
GetTickCount
GetLastError
FileTimeToSystemTime
LocalFree
Sleep
CloseHandle
CompareStringW

ntdll

NtAllocateVirtualMemory
NtCreateSection

ole32

CoCreateInstance

user32

wsprintfW

Sections

.text
Size: 430KB - Virtual size: 429KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 22.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bfcc30be862e35a52b860c504ab173ea

Headers

File Characteristics

Imports

advapi32

secur32

msvcrt

netapi32

kernel32

ntdll

ole32

user32

Sections

.text Size: 430KB - Virtual size: 429KB

.rsrc Size: 34KB - Virtual size: 33KB

.data Size: 51KB - Virtual size: 22.3MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.tls Size: 512B - Virtual size: 4KB

.text
Size: 430KB - Virtual size: 429KB

.rsrc
Size: 34KB - Virtual size: 33KB

.data
Size: 51KB - Virtual size: 22.3MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.tls
Size: 512B - Virtual size: 4KB