701d79c6ff86398867eda6d61a5af61e

Sharing

Copy URL Twitter E-mail

General

Target

701d79c6ff86398867eda6d61a5af61e
Size

535KB
MD5

701d79c6ff86398867eda6d61a5af61e
SHA1

a6884da46d3e5fbe7d78c436729d1d0f8fe259ae
SHA256

8822fbd4614f6604141334361b2bfd3152f651a039f5253cfe4856a9b56be710
SHA512

b81d9a47517a66c49c965d097fbf7ce56c5a977efed2b674f36f826d0d02bbdd9c077bab8874836a4229926b612ca92b3379bfbdb6f9698ed067a45d2dd5ab5d
SSDEEP

12288:aYN4CSFk8mnwNIzaUIQJ9nlq1+LAkRBjJrmWcS1q32DouhjYuBp6:fyZFkDwNIa09nlq1EAkR/rL1KghjYu6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
701d79c6ff86398867eda6d61a5af61e

Files

701d79c6ff86398867eda6d61a5af61e
.exe windows:4 windows x86 arch:x86

6c1f224b59d95ee2983ea2b9359406e8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetMetaFileBitsEx
GetSystemPaletteEntries
DeleteDC
ExtTextOutA
EqualRgn
GetKerningPairsA
MaskBlt
GetObjectW
StartPage
ExtEscape
DeleteObject
BeginPath
DeviceCapabilitiesExW
GetMiterLimit
EnumFontFamiliesExW
SetSystemPaletteUse
GetPaletteEntries
ScaleViewportExtEx

shell32

SHGetPathFromIDListW

advapi32

CryptAcquireContextA
RegCreateKeyW
RegDeleteKeyA
LogonUserA
InitiateSystemShutdownA
CryptSetHashParam
CryptEnumProvidersW
RegReplaceKeyW
CryptDuplicateKey
RegOpenKeyW
CryptGetKeyParam
LookupAccountNameW
CryptDestroyKey
LookupPrivilegeNameW
CryptSignHashA
RegOpenKeyExW
RegQueryValueW
RevertToSelf
RegCreateKeyExA

user32

CopyIcon
CreateAcceleratorTableW
SetPropA
RegisterClassExA
RegisterClassA

comctl32

InitCommonControlsEx

kernel32

GetProcAddress
LCMapStringW
GetOEMCP
CompareStringW
lstrcmpiA
HeapCreate
GetModuleFileNameA
IsBadWritePtr
TlsSetValue
LCMapStringA
GetTimeFormatA
GetLocaleInfoA
CreateMutexA
CompareStringA
InitializeCriticalSection
GetLastError
VirtualFree
TerminateProcess
GetSystemTimeAsFileTime
TryEnterCriticalSection
HeapReAlloc
HeapAlloc
InterlockedExchange
IsValidCodePage
GetModuleFileNameW
FlushConsoleInputBuffer
HeapFree
GetStartupInfoW
HeapDestroy
LeaveCriticalSection
FreeEnvironmentStringsA
HeapSize
GetEnvironmentStringsW
GetUserDefaultLCID
TlsAlloc
WriteFile
GetACP
QueryPerformanceCounter
GetModuleHandleA
SetFilePointer
RtlUnwind
GetCurrencyFormatW
GetCurrentProcessId
TlsGetValue
LoadLibraryExW
EnumSystemLocalesA
VirtualQuery
GetDateFormatA
GetEnvironmentStrings
GetCurrentProcess
EnterCriticalSection
GetCommandLineW
ReadFile
VirtualProtect
TlsFree
GetFileType
FreeEnvironmentStringsW
GetTimeZoneInformation
ExitProcess
GetStartupInfoA
SetHandleCount
IsValidLocale
SetStdHandle
GetSystemInfo
GetVersionExA
GetCurrentThreadId
GetPrivateProfileStringW
CloseHandle
DeleteCriticalSection
SetLastError
SetEnvironmentVariableA
OpenMutexA
SetFileTime
GetCurrentThread
LocalLock
GetCommandLineA
SetThreadLocale
GetStringTypeW
GetLocaleInfoW
GetStringTypeA
LoadLibraryA
GetCPInfo
MultiByteToWideChar
CommConfigDialogA
GetStdHandle
VirtualAlloc
FlushFileBuffers
UnhandledExceptionFilter
WideCharToMultiByte
GetTickCount

comdlg32

PageSetupDlgA
ChooseColorA

Sections

.text
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c1f224b59d95ee2983ea2b9359406e8

Headers

File Characteristics

Imports

gdi32

shell32

advapi32

user32

comctl32

kernel32

comdlg32

Sections

.text Size: 206KB - Virtual size: 205KB

.rdata Size: 8KB - Virtual size: 17KB

.data Size: 314KB - Virtual size: 314KB

.rsrc Size: 5KB - Virtual size: 5KB

.text
Size: 206KB - Virtual size: 205KB

.rdata
Size: 8KB - Virtual size: 17KB

.data
Size: 314KB - Virtual size: 314KB

.rsrc
Size: 5KB - Virtual size: 5KB