71a28278d7d414168049683a5d80b145

Sharing

Copy URL

Twitter E-mail

General

Target

71a28278d7d414168049683a5d80b145
Size

308KB
MD5

71a28278d7d414168049683a5d80b145
SHA1

eb72e25b26aed51a1412379501572a922dec4244
SHA256

32d8b745be7e37285e88faa0b5eb386e20e6321f54521e31d440c308c6f925dd
SHA512

57199165effc0d82ca2eb3b131f19eb77ee7ba80b7d5966d13cde3d160cf13c9b6a66807bb8767257e5dde7bdad7ea0008e4b1bee168d80a74c1585d659cd011
SSDEEP

6144:XVGlneQPW0vIl7RL9IQzndgAqL7N1BB6FaqYdImEmOkocsP/x1f8R6DNr:XVGlapll7zndgAqN1ytyPQP/Ak

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71a28278d7d414168049683a5d80b145

Files

71a28278d7d414168049683a5d80b145
.exe windows:4 windows x86 arch:x86

df8df839411f4d42219f8ba393e8f95c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comdlg32

GetOpenFileNameA
PrintDlgA
ReplaceTextW

shell32

SHEmptyRecycleBinA
DragAcceptFiles

comctl32

InitCommonControlsEx

advapi32

LogonUserA
RegCloseKey
RegEnumKeyExA
RegCreateKeyW
CryptDuplicateHash
RegEnumKeyExW
RegDeleteKeyW
CryptAcquireContextA
RegConnectRegistryA
LookupSecurityDescriptorPartsW
RegRestoreKeyA
RevertToSelf
CryptHashSessionKey
InitializeSecurityDescriptor
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegOpenKeyExW
CryptGetDefaultProviderA
CryptSetKeyParam
StartServiceA

kernel32

WaitForDebugEvent
GetStartupInfoA
AllocConsole
TlsGetValue
GetOEMCP
InterlockedIncrement
CompareStringA
SetFilePointer
TlsSetValue
FreeEnvironmentStringsW
WriteFile
EnterCriticalSection
VirtualQuery
GetEnvironmentStringsW
GetModuleHandleA
SetConsoleOutputCP
HeapFree
GetProcAddress
InterlockedExchange
GetPrivateProfileSectionNamesW
GetFileType
TlsAlloc
QueryPerformanceCounter
GetCurrentThreadId
UnmapViewOfFile
GetStringTypeW
InitializeCriticalSection
LCMapStringW
MultiByteToWideChar
GetCurrentThread
CloseHandle
ReadFile
IsBadWritePtr
SetStdHandle
GetModuleFileNameA
SetHandleCount
GetCommandLineA
LCMapStringA
TerminateProcess
lstrcpy
FlushFileBuffers
VirtualAlloc
IsValidCodePage
ReleaseMutex
LeaveCriticalSection
FindNextFileW
lstrcmpiW
GetACP
HeapReAlloc
AddAtomW
WideCharToMultiByte
GetCPInfo
OpenMutexA
GetLocalTime
DeleteCriticalSection
GetSystemTime
RtlUnwind
ReadFileEx
CreateDirectoryExA
GetStdHandle
OpenFileMappingA
GetVersion
TlsFree
CompareStringW
UnhandledExceptionFilter
LoadLibraryA
GetTimeZoneInformation
VirtualFree
SetEnvironmentVariableW
HeapAlloc
InterlockedDecrement
ExitProcess
GetLastError
HeapCreate
GetEnvironmentStrings
GetCurrentProcess
SetLastError
FreeEnvironmentStringsA
HeapDestroy
CreateMutexA
FreeLibraryAndExitThread
LockFile
GetNumberFormatW
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetTickCount
SetEnvironmentVariableA

user32

CallWindowProcA
CharToOemA
GetTabbedTextExtentW
SetDoubleClickTime
CharToOemBuffA
SetWindowPlacement
RegisterClassExA
CharNextExA
SetFocus
VkKeyScanA
GetMenuStringA
RegisterClassA
GetPropA
OpenWindowStationW

Sections

.text
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df8df839411f4d42219f8ba393e8f95c

Headers

File Characteristics

Imports

comdlg32

shell32

comctl32

advapi32

kernel32

user32

Sections

.text Size: 180KB - Virtual size: 179KB

.rdata Size: 22KB - Virtual size: 46KB

.data Size: 87KB - Virtual size: 86KB

.rsrc Size: 18KB - Virtual size: 18KB

.text
Size: 180KB - Virtual size: 179KB

.rdata
Size: 22KB - Virtual size: 46KB

.data
Size: 87KB - Virtual size: 86KB

.rsrc
Size: 18KB - Virtual size: 18KB