7d9fe6da414b9f7d9f0ee004a141ac0d

General

Target

7d9fe6da414b9f7d9f0ee004a141ac0d
Size

332KB
MD5

7d9fe6da414b9f7d9f0ee004a141ac0d
SHA1

b348ba63b00de384e8f980b96a1807d0c3252a95
SHA256

e4cea0afff1800d8da994e786f83f4a613a9d119daf77bf4c029e80c92d13813
SHA512

6f364a090d68d48a0eae3f85b47bb01bfb0aeef22d55d81698cbff51cde9b696fe70a5cb7a949002d0bd13cbe3ec3f0184a80e8d7887449de81bd6f249bc496a
SSDEEP

6144:QQgEq2nDGAb6+4pACF/ZodJUNM/APXjQkCyTjd:Pq2n5cvF/lNVXcktV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d9fe6da414b9f7d9f0ee004a141ac0d

Files

7d9fe6da414b9f7d9f0ee004a141ac0d
.exe windows:4 windows x86 arch:x86

8dcacaad45a1a52801345299958ad644

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

k:\FileBase\Yilin\works\RP\SecurityPrograms\Projects\Emails\EmailBot\Final\Bot\Release\WmUpdate.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetLastError
CompareStringW
CompareStringA
FlushFileBuffers
CloseHandle
CreateFileA
ReadFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
RtlUnwind
RaiseException
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
InitializeCriticalSection
MultiByteToWideChar
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
SetEnvironmentVariableA

user32

PostQuitMessage
DefWindowProcA
CreateWindowExA
LoadCursorA
RegisterClassExA
GetMessageA
TranslateMessage
DispatchMessageA

Sections

.text
Size: 244KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8dcacaad45a1a52801345299958ad644

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 244KB - Virtual size: 242KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 24KB - Virtual size: 47KB

.text
Size: 244KB - Virtual size: 242KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 24KB - Virtual size: 47KB