7d2679b90cd34d4c0e68b728dedd78a9

Sharing

Copy URL Twitter E-mail

General

Target

7d2679b90cd34d4c0e68b728dedd78a9
Size

180KB
MD5

7d2679b90cd34d4c0e68b728dedd78a9
SHA1

a7f209ea80331b4e2ece81d87f3c6d3cc775441b
SHA256

02b68982b86c2cc682fb184d0e2d87bce81206eea8151041a1936cde7a47756f
SHA512

af4145563f4d94617d3161702d1aa6bbf3b87699dba3b233dd14abfa00636b596b7429c7034ccd852f841a4a260259db6fd56133d841c8cd68d23b4dfc7ff9bd
SSDEEP

3072:1OFG+pjJyYct/yMkXCOqmNFYMP3hStm+9NS81+jem9TLiqjD5ofj4oz3:1OF1VyYm/yMkzF+9Lgzxn5ofEoz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d2679b90cd34d4c0e68b728dedd78a9

Files

7d2679b90cd34d4c0e68b728dedd78a9
.exe windows:4 windows x86 arch:x86

3177469dc50b335b98e53ef63d68871c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
LoadLibraryW
CreateProcessW
GetProcAddress
lstrcmpA
GetCurrentProcess
GetLocalTime
WriteConsoleA
GetSystemTime
GetCurrentThreadId
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
WriteFile
RtlUnwind
GetFileType
GetStdHandle
Sleep
GetModuleFileNameW
GetFileTime
GetCurrentProcessId
WideCharToMultiByte
LCMapStringA
ExitProcess
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
LCMapStringW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
VirtualAlloc
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree

user32

GetKeyNameTextW
IsDlgButtonChecked
SetWindowTextA
SendMessageTimeoutA
CallNextHookEx
CheckDlgButton
GetIconInfo
IsDialogMessageW
LoadBitmapA
SetDlgItemTextA
DrawEdge

gdi32

AbortDoc
SetRectRgn
CombineRgn
EndDoc
GetDeviceCaps
SetAbortProc

ws2_32

WSAAddressToStringA
WSACloseEvent
WSAGetOverlappedResult
WSASocketA
WSAConnect
WSACleanup
WSAStartup
WSACreateEvent

version

GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3177469dc50b335b98e53ef63d68871c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ws2_32

version

Sections

.text Size: 64KB - Virtual size: 62KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 68KB - Virtual size: 400KB

.tls Size: 4KB - Virtual size: 80B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 64KB - Virtual size: 62KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 68KB - Virtual size: 400KB

.tls
Size: 4KB - Virtual size: 80B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 2KB