70ef2f9684e2a4305ed573027f7e32fb

Sharing

Copy URL Twitter E-mail

General

Target

70ef2f9684e2a4305ed573027f7e32fb
Size

156KB
MD5

70ef2f9684e2a4305ed573027f7e32fb
SHA1

39ba9381cfd5cacea5b49beeea4dc32f32c701d6
SHA256

7de1d58ab99f95f1aa8d20ad86fdb866a4546dae323dd8e234b0377362410c84
SHA512

c2101fe42c1b6ae2582fbbe6afe9ae7ff615b13f01ae5c2f20aa4427db9e289ebc4a5b14f1105378aa008f85ac3cd8588ddf8786ea3d317ec5b4f0b64fefb2a1
SSDEEP

3072:aFTYSAWynMijBnfwbDVBksIVnnGnAbwudlYtTZixjjJogwx9CyV+:ad1yhmDVOsUnhbZtVjrwx9CyV+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70ef2f9684e2a4305ed573027f7e32fb

Files

70ef2f9684e2a4305ed573027f7e32fb
.exe windows:4 windows x86 arch:x86

1d250c3ec7ecbae7677f08c40f478318

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
SetFilePointer
lstrlenA
ReadFile
GetSystemTime
GetFileSize
GetCurrentProcessId
CreateThread
TerminateThread
GetDriveTypeA
GetLogicalDriveStringsA
FindClose
FindNextFileA
FindFirstFileA
HeapReAlloc
VirtualAlloc
VirtualFree
CreateFileA
GetSystemDirectoryA
lstrcatA
ExitThread
GetTickCount
lstrcmpiA
CreateMutexA
CloseHandle
ExitProcess
GetCurrentThread
SetThreadPriority
Sleep
GetCurrentProcess
RaiseException
GetLocalTime
lstrcpynA
lstrcmpA
GetComputerNameA
GetProcessTimes
CreateProcessA
GetVersionExA
GetTempFileNameA
GetTempPathA
WinExec
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetExitCodeThread
InitializeCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateEventA
SetEvent
WaitForSingleObject
RtlUnwind
MultiByteToWideChar
LCMapStringW
LCMapStringA
WideCharToMultiByte
HeapAlloc
HeapFree
GetModuleHandleA
lstrcpyA
GetFileAttributesA
DeleteFileA
MoveFileA
LoadLibraryA
GetProcAddress
GlobalAlloc
GlobalFree
FreeLibrary
GetLastError
GetModuleFileNameA

user32

CharLowerA
wvsprintfA
wsprintfA

advapi32

ControlService
RegOpenKeyExA
RegQueryValueExA
GetUserNameA
CloseEventLog
ReadEventLogA
OpenEventLogA
RegDeleteKeyA
InitializeAcl
IsValidAcl
RegSetValueExA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
RegCreateKeyA
RegEnumValueA
RegDeleteValueA
RegCloseKey

ole32

CoInitialize
CoUninitialize
CoCreateGuid
StringFromCLSID
CoCreateInstance
CoInitializeSecurity

oleaut32

VariantInit
VariantClear

ws2_32

gethostbyname
WSACleanup
gethostname
inet_ntoa
htons
connect
recv
getpeername
send
setsockopt
accept
socket
closesocket
select
ioctlsocket
shutdown
WSAGetLastError
bind
listen
WSAStartup

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 43KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1d250c3ec7ecbae7677f08c40f478318

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

ws2_32

Sections

.text Size: 112KB - Virtual size: 112KB

.data Size: 43KB - Virtual size: 60KB

.text
Size: 112KB - Virtual size: 112KB

.data
Size: 43KB - Virtual size: 60KB