da22aa13d3d49a8e5ef1f84874d8fe29deba60bc21ec5485c2e80c648833ade4

Sharing

Copy URL Twitter E-mail

General

Target

da22aa13d3d49a8e5ef1f84874d8fe29deba60bc21ec5485c2e80c648833ade4
Size

6.7MB
MD5

d8935b186e61d9d4dd9f2f6a36e24e0e
SHA1

e06009204bef2d985aca1a6c5a2500ef144682ce
SHA256

da22aa13d3d49a8e5ef1f84874d8fe29deba60bc21ec5485c2e80c648833ade4
SHA512

d6964fafb53954f16982e5e391571ce32c08dc6e4ca85418a672532990159dfb6798f06bbb3623e7b1cf9e0899c84b03b44ef61b344eb7f93abbfb5256b1b3f5
SSDEEP

196608:FpR0Vd0LChPeAC93HGGFEsomj3y/u9kxSzP77YK:h3oPeA/GF+mu/u9kxkP/D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da22aa13d3d49a8e5ef1f84874d8fe29deba60bc21ec5485c2e80c648833ade4

Files

da22aa13d3d49a8e5ef1f84874d8fe29deba60bc21ec5485c2e80c648833ade4
.exe windows:5 windows x86 arch:x86

9d20586ede6c14d3276fcaaf05b032a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsSetValue
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

IsZoomed
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

BitBlt

advapi32

RegSetValueExA

ole32

DoDragDrop

oleaut32

SystemTimeToVariantTime

msimg32

TransparentBlt

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA

wininet

InternetReadFile

oleacc

CreateStdAccessibleObject

gdiplus

GdipCreateBitmapFromStream

imm32

ImmReleaseContext

winmm

mciSendCommandA

winspool.drv

DocumentPropertiesA

comdlg32

GetFileTitleA

shell32

SHBrowseForFolderA

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

wtsapi32

WTSSendMessageW

Sections

.text
Size: 1.8MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 739KB - Virtual size: 740KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

1
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

2
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d20586ede6c14d3276fcaaf05b032a8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msimg32

comctl32

shlwapi

wininet

oleacc

gdiplus

imm32

winmm

winspool.drv

comdlg32

shell32

msvcrt

iphlpapi

psapi

wtsapi32

Sections

.text Size: 1.8MB - Virtual size: 4.4MB

.sedata Size: 739KB - Virtual size: 740KB

.idata Size: 1KB - Virtual size: 4KB

0 Size: 46KB - Virtual size: 48KB

.sedata Size: 4KB - Virtual size: 4KB

1 Size: 2.1MB - Virtual size: 2.1MB

2 Size: 1.9MB - Virtual size: 1.9MB

.rsrc Size: 46KB - Virtual size: 45KB

.text
Size: 1.8MB - Virtual size: 4.4MB

.sedata
Size: 739KB - Virtual size: 740KB

.idata
Size: 1KB - Virtual size: 4KB

0
Size: 46KB - Virtual size: 48KB

.sedata
Size: 4KB - Virtual size: 4KB

1
Size: 2.1MB - Virtual size: 2.1MB

2
Size: 1.9MB - Virtual size: 1.9MB

.rsrc
Size: 46KB - Virtual size: 45KB