7c290f62050c8584883f452dc65770d8

Sharing

Copy URL Twitter E-mail

General

Target

7c290f62050c8584883f452dc65770d8
Size

62KB
MD5

7c290f62050c8584883f452dc65770d8
SHA1

869527f1984aab45aa11e56643b3ac084bf5af43
SHA256

a7c3b9d1b6d7636ee58a545eec1780d50bb8d4b0eed3fe3fe0fb799d314c2e9c
SHA512

96d6234dc7e963f5eaefc4f64dd59b1de38cb46ec6ea83f497ae75ad4e60597b705bd1c2898d5ea8b1fd31d94447dc0db6a9260775024767460fd847fd328e2f
SSDEEP

1536:hWxBCRsAp0oeZSeLkP25sDjU9P4MZ2fsCGEmuYhzrPj:hzizQbjU9AMZ2fsCpzYhzr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c290f62050c8584883f452dc65770d8

Files

7c290f62050c8584883f452dc65770d8
.exe windows:4 windows x86 arch:x86

df3b97187e808724db41f22a316b6db5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

isgraph
strcspn
atoi
memcpy
memmove
strlen
memchr
isalpha
_vsnprintf
strstr
memset
strcmp
_allshl

kernel32

GetPrivateProfileIntW
WideCharToMultiByte
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
GetCurrentProcess
lstrcatW
WriteFile
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcmpiW
LocalFree
lstrcmpA
GetPrivateProfileIntA
GetVolumeInformationA
GetSystemDirectoryA
GetLastError
DeviceIoControl
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
FindFirstFileA
LocalAlloc
LocalReAlloc
lstrcpynW
Sleep
CreateProcessA
GetVersion
GetSystemTime
DeleteFileA
CreateThread
GetTickCount
TerminateThread
ExitThread
GetCurrentThreadId
lstrcmpiA
Process32First
GetLogicalDrives
GetDriveTypeA
OpenProcess
Process32Next
CreateToolhelp32Snapshot
GetDiskFreeSpaceExA
WaitForSingleObject
GetExitCodeThread
GetModuleFileNameA
SetFilePointer
SetEvent
InitializeCriticalSection
FindNextFileA
LeaveCriticalSection
CreateDirectoryA
EnterCriticalSection
SetFileAttributesA
ResetEvent
GetTimeFormatA
GetDateFormatA
FindClose
ExpandEnvironmentStringsA
GetFileAttributesA
GetPrivateProfileStringA
lstrcmpW
lstrcpynA
lstrcpyA
lstrcatA
CreateFileA
GetFileSize
ReadFile
CloseHandle
lstrlenA
MultiByteToWideChar
lstrcpyW
lstrlenW
GetSystemTimeAsFileTime
CreateEventA

user32

wsprintfA
wsprintfW

advapi32

CryptCreateHash
RegDeleteValueA
RegEnumValueA
RegFlushKey
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegOpenKeyExA
RegCreateKeyExA
RevertToSelf
DuplicateTokenEx
ImpersonateSelf
SetThreadToken
CryptGetHashParam
CryptDestroyHash
RegQueryValueExW
RegSetValueExA
RegEnumKeyA
RegLoadKeyA
RegUnLoadKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CryptReleaseContext
CryptAcquireContextA
RegDeleteKeyA
RegCreateKeyA
CryptHashData

wininet

InternetOpenA
FtpPutFileA
InternetReadFile
InternetConnectA
InternetOpenUrlA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetCloseHandle

ws2_32

accept
listen
__WSAFDIsSet
bind
WSAGetLastError
select
recvfrom
ntohs
WSAStartup
getsockname
send
gethostbyname
closesocket
socket
recv
htons
inet_addr
inet_ntoa
connect
sendto
ioctlsocket
setsockopt

ole32

CoTaskMemFree

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df3b97187e808724db41f22a316b6db5

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

wininet

ws2_32

ole32

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 2KB - Virtual size: 86KB

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 2KB - Virtual size: 86KB