88acd62505110f53cea9b65c0af334d3

Sharing

Copy URL Twitter E-mail

General

Target

88acd62505110f53cea9b65c0af334d3
Size

164KB
MD5

88acd62505110f53cea9b65c0af334d3
SHA1

c39a597d4c2dbe23b4358e9d1e4bf1b871472668
SHA256

3e408804f11631c8ec9b484f23ba913d7049c3a7332d48220f0778ff5a386184
SHA512

fe035e89497447b45a7e49107a60abb8c12813c68f7329fbdbef2c4856b4b491233edbfdfad09dac30296c0a51355f3ad17810c8170e5c7993acfb74c4a81b08
SSDEEP

3072:E4utYUdYtCB6VnaB0FvqM8SuJOq0AKA8yo/vKOF+aMM+4:QYBaBoqC0Oq0AKAOi4+Zn4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88acd62505110f53cea9b65c0af334d3

Files

88acd62505110f53cea9b65c0af334d3
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

b0d46dd76dec772e20a68a8a0cf95689

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
WriteFile
CreateFileA
GetVersionExA
WinExec
GetModuleFileNameA
GetLastError
GetCurrentProcess
SetFileTime
GetFileAttributesExA
GetStartupInfoA
GetModuleHandleA
DuplicateHandle
GetSystemDirectoryA
CloseHandle
CreateProcessA
WaitForSingleObject
TerminateProcess
Sleep
FreeLibrary
WideCharToMultiByte
LoadLibraryA
GetProcAddress

user32

GetMessageA
SendMessageTimeoutA
RegisterWindowMessageA
TranslateMessage
PostMessageA
EnumChildWindows
GetWindowThreadProcessId
EnumWindows
ShowWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
GetDesktopWindow
DispatchMessageA
GetClassNameA
PostQuitMessage

advapi32

GetUserNameA
OpenSCManagerA
StartServiceA
OpenServiceA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CreateServiceA
ConvertSidToStringSidA
LookupAccountNameA
DeleteService
CloseServiceHandle

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize
CoUninitialize

oleaut32

SysFreeString
VariantClear

msvcrt

fwrite
_strlwr
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_access
??2@YAPAXI@Z
??3@YAXPAX@Z
fopen
_stricmp
srand
time
wcslen
atoi
strchr
strstr
rand
__CxxFrameHandler
sprintf
fclose
fflush

shlwapi

SHGetValueA
SHSetValueA

dbghelp

ImageNtHeader

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

edata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0d46dd76dec772e20a68a8a0cf95689

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

dbghelp

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 116KB - Virtual size: 113KB

mdata Size: 4KB - Virtual size: 4B

edata Size: 4KB - Virtual size: 4B

cdata Size: 4KB - Virtual size: 4B

idata Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 116KB - Virtual size: 113KB

mdata
Size: 4KB - Virtual size: 4B

edata
Size: 4KB - Virtual size: 4B

cdata
Size: 4KB - Virtual size: 4B

idata
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 1KB