76811b6da4a7a1930e7a091edf71e223

Sharing

Copy URL Twitter E-mail

General

Target

76811b6da4a7a1930e7a091edf71e223
Size

148KB
MD5

76811b6da4a7a1930e7a091edf71e223
SHA1

e5a0860ccf51bd540a5780c41deb6928b69825de
SHA256

3e2290c41398c3bc8eff68682742b343878832077861dfa8ea75e07c3e09f438
SHA512

e846f16f2cba79d32a1fa4904b980778e63280d76e85a8bc7cbcadac10fbb3070b5f3f171d2afd672c835b8490430411c800b659c531226a448e4efbefffd6d4
SSDEEP

3072:HvgfRHs3IGcucFYXMKNTrXATuzDCqaQZ6WkAOZTQ9fM:oxs3hcaXMarXpXCqhAWkRZ6f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76811b6da4a7a1930e7a091edf71e223

Files

76811b6da4a7a1930e7a091edf71e223
.exe windows:5 windows x86 arch:x86

e983af624a7dbe76c6fb8b0cb6ec5916

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

DoEnvironmentSubstW
ExtractIconExA
ExtractIconW
DragAcceptFiles
DragFinish

advapi32

CreateProcessAsUserW
SetSecurityDescriptorControl
RegLoadKeyW
GetSecurityDescriptorControl
LookupPrivilegeDisplayNameA
SetSecurityDescriptorSacl
SetServiceStatus
LookupPrivilegeNameA
ObjectCloseAuditAlarmW

kernel32

GetModuleFileNameA
SetStdHandle
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetLastError
HeapFree
CreateFileW
CloseHandle
HeapAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
DecodePointer
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteConsoleW
MultiByteToWideChar
Sleep
RtlUnwind
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
LoadLibraryW
GetStringTypeW
HeapReAlloc
GetConsoleCP
FlushFileBuffers
LCMapStringW
ReadFile
SetFilePointer

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e983af624a7dbe76c6fb8b0cb6ec5916

Headers

DLL Characteristics

File Characteristics

Imports

shell32

advapi32

kernel32

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 113KB

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 113KB

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 5KB - Virtual size: 5KB