72ac092866afe8361f14b9be630c2b57

Sharing

Copy URL Twitter E-mail

General

Target

72ac092866afe8361f14b9be630c2b57
Size

84KB
MD5

72ac092866afe8361f14b9be630c2b57
SHA1

54b314450e5b7fff7388adbb80cf434ab42580a0
SHA256

7310e222f9d8d80dfe40f13173a4202757f504550f76c71d9b320d55cae7de61
SHA512

ba1cd3fc5b041f13f10d9134b09ca87a2df1a4fcf06daa60069e0755b59af74cf17c750e0196aaafb701cc34d004ca94065e9219a0ddbbbb185e2903cc08edc9
SSDEEP

1536:I5pZUoChLxj0YJpLp72BkITeogRnLYxTrGFqYQT6lEk4jL4B5l+MtvuGk7W3Xmye:ipiZ3LZ2BZTGwdNTmEfKl1NRM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72ac092866afe8361f14b9be630c2b57

Files

72ac092866afe8361f14b9be630c2b57
.exe windows:5 windows x86 arch:x86

d4e016de31a8b7db0e0dd2eb2e1e3428

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
FindResourceA
CompareFileTime
GetConsoleAliasW
SearchPathA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
lstrcmpA
GetConsoleCommandHistoryW
VirtualAlloc
GetTickCount
Module32NextW
CreateFileW
ExitVDM
LCMapStringW
GetCurrentThreadId
DeleteFiber
GetFirmwareEnvironmentVariableW
GetCompressedFileSizeW
RemoveLocalAlternateComputerNameW
GetConsoleAliasesLengthA

msvcrt40

_jn
??_Estdiobuf@@UAEPAXI@Z
raise
_wcsicmp
??_Dstdiostream@@QAEXXZ
_wmkdir
labs
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
_dup2
__p___initenv
_ismbbalnum
_spawnvpe
abort
_yn
_mbsspnp
_HUGE
??_Efilebuf@@UAEPAXI@Z

crtdll

_ismbcupper
feof
_fdopen
_strinc
_rotl
_spawnle
_dup2
_CIlog10
_mbsrchr
_commode_dll
_strset
__threadid
_mbstrlen
strcoll
_putch
wcsxfrm
__toascii

davclnt

NPFormatNetworkName
NPAddConnection3
DllCanUnloadNow
NPCloseEnum
NPGetUniversalName
NPCancelConnection
NPGetUser
NPEnumResource
NPGetResourceParent
NPOpenEnum
NPAddConnection
DavGetDiskSpaceUsage
NPGetCaps

msvcp60

??0length_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?max@?$numeric_limits@C@std@@SACXZ
??4?$numeric_limits@H@std@@QAEAAV01@ABV01@@Z
?imag@std@@YAMABV?$complex@M@1@@Z
?name@locale@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4ios_base@std@@QAEAAV01@ABV01@@Z
??_Ffacet@locale@std@@QAEXXZ
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@XZ
?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?_Doraise@overflow_error@std@@MBEXXZ

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4e016de31a8b7db0e0dd2eb2e1e3428

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt40

crtdll

davclnt

msvcp60

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 20KB - Virtual size: 24KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 336B

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 20KB - Virtual size: 24KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 336B