8fa1cfb82c25115423d91f1c4f55f9bf7a53c0b50c0144ecc4b520bf9a7bd225

Sharing

Copy URL Twitter E-mail

General

Target

8fa1cfb82c25115423d91f1c4f55f9bf7a53c0b50c0144ecc4b520bf9a7bd225
Size

11KB
MD5

3ce11c2d3a33fa4a9116f7d87408afa3
SHA1

119152491ecf7920464f9ecd81bde0fa3baa5603
SHA256

8fa1cfb82c25115423d91f1c4f55f9bf7a53c0b50c0144ecc4b520bf9a7bd225
SHA512

668f27342ecc354a46727d3af13ac47c59ea5ebabcbd1e25c9ccd14e8e4a47164c02b30b576af50ebfdee4f0768b983c6fafb6588174773fd5a7b6e3b847008e
SSDEEP

192:K7v3jwdyz5xyxhlq2HH5XRpLiTHLjx0pekACe//kps6ohANMTcWdI/Dn2kqwuxt:uLwdyzyx95XLLi7Ljx0oi8/b6uiMTJ4A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8fa1cfb82c25115423d91f1c4f55f9bf7a53c0b50c0144ecc4b520bf9a7bd225

Files

8fa1cfb82c25115423d91f1c4f55f9bf7a53c0b50c0144ecc4b520bf9a7bd225
.exe windows:4 windows x86 arch:x86

c51e5bc2e95944f4bcba9572cdd78289

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
WaitForSingleObject
CloseHandle
GetCurrentProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetExitCodeThread
VirtualFreeEx
CreateRemoteThread
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
GetCurrentProcessId
GetPriorityClass
WideCharToMultiByte
Sleep
GetModuleHandleW
OutputDebugStringA
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetSystemTime
MultiByteToWideChar
InterlockedExchange
QueryPerformanceCounter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
InterlockedCompareExchange

advapi32

LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges

unhookdll

?g_pId@@3KA
?g_dllToUnload@@3PADA
?g_injectedDllPath@@3PA_WA

msvcr80

_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
_initterm_e
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_wcsicmp
sprintf
_vsnprintf
memset
memcpy
_amsg_exit
__CxxFrameHandler3

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c51e5bc2e95944f4bcba9572cdd78289

Headers

File Characteristics

Imports

kernel32

advapi32

unhookdll

msvcr80

msvcp80

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 920B

.rsrc Size: 512B - Virtual size: 432B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 920B

.rsrc
Size: 512B - Virtual size: 432B