6709acd3b2946fd3ee42680be25707cc

Sharing

Copy URL Twitter E-mail

General

Target

6709acd3b2946fd3ee42680be25707cc
Size

847KB
MD5

6709acd3b2946fd3ee42680be25707cc
SHA1

9c1c6acb1a074dc5dd413e714037e5b73906a3ac
SHA256

096b0db9602fc1cf458211834ecdaff12fa0ef3f2c2b3dd13c7dcae7c35d01e6
SHA512

49c9fa4b704aabb4f238e2c26c85f1e39255cde432c51e0230ce727593297a1037d1020678f035fda31a89f271c470e17e412958e1adf0834f2d4a78dc428344
SSDEEP

12288:RfEB0WoiXWV4uXJq/8szNefMvV0I8UHt1KVE5Ww5II7ddHyZpnuKeWKaSi:RAZu5q9zEfMd0I86tUwSKddHy7uPWci

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6709acd3b2946fd3ee42680be25707cc

Files

6709acd3b2946fd3ee42680be25707cc
.exe windows:5 windows x86 arch:x86

6ad2e6e7772de1d775af49a9552d6078

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

cfgmgr32

CM_Get_Depth_Ex

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

ole32

CoInitialize
CoUninitialize
CoCreateGuid

advapi32

CryptGetUserKey
CryptSetKeyParam
CryptGenKey
CryptDestroyKey
CryptAcquireContextA
CryptGetProvParam
CryptReleaseContext

kernel32

GetUserDefaultUILanguage
GetModuleHandleW
TerminateProcess
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetProcAddress
CompareFileTime
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
CloseHandle
UnmapViewOfFile
FindResourceA
LoadResource
SizeofResource
LockResource
FreeResource
SetLastError
SystemTimeToFileTime
LocalFileTimeToFileTime
GetLastError
MapViewOfFile
CreateFileMappingA
GetFileSize
WriteFile
WideCharToMultiByte
LocalAlloc
GetVersionExA
MultiByteToWideChar
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW

user32

LoadStringA
LoadStringW

crypt32

CertFreeCertificateContext
CertSetCertificateContextProperty
CertAddEncodedCertificateToStore
CertOpenStore
CertCreateCertificateContext
CryptDecodeObject
CertComparePublicKeyInfo
CryptExportPublicKeyInfo
CryptEncodeObject
CryptQueryObject
CertStrToNameW
CryptHashPublicKeyInfo
CryptHashCertificate
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertCompareIntegerBlob
CryptSignAndEncodeCertificate
CertCloseStore

mssign32

GetCryptProvFromCert
FreeCryptProvFromCert
PvkFreeCryptProv
PvkPrivateKeySave
SignError
PvkGetCryptProv
PvkPrivateKeyAcquireContextFromMemory

shlwapi

SHDeleteKeyA

msvcrt

exit
_cexit
__winitenv
_exit
_c_exit
strtok
??2@YAPAXI@Z
??3@YAXPAX@Z
wcslen
_wtol
_wcsnicmp
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
free
_wcsicmp
vwprintf
wprintf
malloc
swprintf
_XcptFilter
wcscpy
__wgetmainargs

Sections

.text
Size: 603KB - Virtual size: 602KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 237KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ad2e6e7772de1d775af49a9552d6078

Headers

File Characteristics

Imports

cfgmgr32

rpcrt4

ole32

advapi32

kernel32

user32

crypt32

mssign32

shlwapi

msvcrt

Sections

.text Size: 603KB - Virtual size: 602KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 237KB - Virtual size: 3.6MB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 603KB - Virtual size: 602KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 237KB - Virtual size: 3.6MB

.rsrc
Size: 2KB - Virtual size: 2KB