8b13fecd8947956f1647dcf4d8750851

Sharing

Copy URL Twitter E-mail

General

Target

8b13fecd8947956f1647dcf4d8750851
Size

138KB
MD5

8b13fecd8947956f1647dcf4d8750851
SHA1

f5418eae384e081f92865408258164b477ea3aa2
SHA256

e20bda18cfcf7eecf98afee7e3c1a56fb491533d3e5db066fd98cea584c2b8df
SHA512

60f80159ae92cca9ea2cc52f6895f747666680409718cc34feeb93c1b859c7473246961f17c6229440bbf09e62c02fb55b30cfab8782eb5c8e8c77f9d2d99317
SSDEEP

3072:y0998xrjORwoR54G87Mre3FAwK3MHV3IyoqAkkfroDY2OP1fFXBDit:y099KjORwy54GcMre3Fo3MHV3IydArfM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b13fecd8947956f1647dcf4d8750851

Files

8b13fecd8947956f1647dcf4d8750851
.exe windows:4 windows x86 arch:x86

e1801656a43e9b0ea2cb48345184be94

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetModuleFileNameA
Sleep
lstrcpyA
lstrlenA
lstrcatA
CopyFileA
CreateDirectoryA
ExitThread
CreateThread
TerminateThread
CloseHandle
GetTempPathA
DeleteFileA
CreateFileA
GetFileSize
ReadFile
SetFilePointer
LoadLibraryA
MultiByteToWideChar
GetProcAddress
TransactNamedPipe
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetSystemDirectoryA
GetWindowsDirectoryA
FindResourceA
LoadResource
SizeofResource
LockResource
WriteFile
GetModuleHandleA
ExitProcess
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetVersionExA
WinExec
CreateMutexA
GetLastError
GetSystemTime
lstrcmpA
lstrcmpiA
GetProcessHeap
HeapAlloc
lstrcpynA
GlobalFree
InterlockedIncrement
InterlockedDecrement
HeapFree
GetTempFileNameA
GlobalAlloc
FindFirstFileA
FindNextFileA
FindClose
GetEnvironmentVariableA
GetDriveTypeA
GetCurrentThread
SetThreadPriority
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeZoneInformation
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
SetCurrentDirectoryA
GetFullPathNameA
GetStartupInfoA

user32

wsprintfA
CharLowerA
EnumWindows
GetClassNameA
SendMessageA
EnumChildWindows
FindWindowA
MessageBoxA
CharUpperBuffA
CharUpperA
wvsprintfA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA

shell32

ShellExecuteA

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileA

odbc32

ord24
ord75
ord31
ord41
ord11
ord9

msvcrt

strlen
rand
fopen
fclose
memset
sprintf
srand
sscanf
strcmp
fread
feof
strcpy
strcat
_strdup
strstr
strncpy
strncat
free
_splitpath
memcpy
malloc
memcmp
_snprintf
time
strrchr
strtok
calloc
_stricmp
fprintf
_makepath
tmpnam
strchr
fseek
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_controlfp

ws2_32

closesocket
socket
getsockname
setsockopt
ioctlsocket
htons
bind
listen
select
__WSAFDIsSet
accept
send
recv
inet_addr
connect
recvfrom
sendto
inet_ntoa
gethostbyname
ntohs
WSAGetLastError
htonl
shutdown
gethostname
WSAStartup
WSACleanup

mpr

WNetAddConnection2A

rpcrt4

UuidFromStringA
UuidToStringA

Sections

.text
Size: 130KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1801656a43e9b0ea2cb48345184be94

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wininet

urlmon

odbc32

msvcrt

ws2_32

mpr

rpcrt4

Sections

.text Size: 130KB - Virtual size: 139KB

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 130KB - Virtual size: 139KB

.rsrc
Size: 7KB - Virtual size: 6KB