8a3f2b88e8a2d7e5896c41ad7f512f30

Sharing

Copy URL Twitter E-mail

General

Target

8a3f2b88e8a2d7e5896c41ad7f512f30
Size

13KB
MD5

8a3f2b88e8a2d7e5896c41ad7f512f30
SHA1

3952e222107d0636688fadae61788fa7f6a0c6c2
SHA256

badcfd8d2557f5653f968aa07d40a39d3b395b634bf0dc32bb32fe3bef967be1
SHA512

d4aff73a7864e2589ab3d60487bd2107bc93c67d9df06829546d853b681ac9325056cfd9b48a071eaabc479582b1539a72ef1bbe13d6126cc536384544e3bf74
SSDEEP

192:BMj7i2NM+LKtCssJ+9fr16zESMT3LXnczwPJJ0OC8qWg:x2PrOfr4glT3LXc0JuOCOg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a3f2b88e8a2d7e5896c41ad7f512f30

Files

8a3f2b88e8a2d7e5896c41ad7f512f30
.exe windows:5 windows x86 arch:x86

2b2116fbd67a3e7af0a7684c9868cd3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetLastError
GetCurrentProcess
GetModuleFileNameA
GetConsoleWindow
OutputDebugStringA
GetWindowsDirectoryA
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32First
ProcessIdToSessionId
Process32Next
LoadLibraryA
GetProcAddress
OpenProcess
Sleep
CloseHandle
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
InterlockedCompareExchange
InterlockedExchange

user32

ShowWindow

advapi32

SetTokenInformation
DeleteService
StartServiceA
SetServiceStatus
OpenServiceA
ControlService
OpenSCManagerA
CreateServiceA
ChangeServiceConfig2A
CloseServiceHandle
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
CreateProcessAsUserA
AdjustTokenPrivileges
DuplicateTokenEx

userenv

CreateEnvironmentBlock

msvcr90

strlen
??3@YAXPAX@Z
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
memset
__CxxFrameHandler3
strcpy
_stricmp

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b2116fbd67a3e7af0a7684c9868cd3d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

userenv

msvcr90

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB