8b016ece0e51c1dc15bc35e121b131e1

Sharing

Copy URL Twitter E-mail

General

Target

8b016ece0e51c1dc15bc35e121b131e1
Size

92KB
MD5

8b016ece0e51c1dc15bc35e121b131e1
SHA1

54f20c95ac0a2b1af18f489d9c209ca1c2b16341
SHA256

2a3701642f9d16f3e8c1c9a005c16757b5330df179262cb98db2b4445fb7a9f9
SHA512

e66006c16b8ff075c0bf862b8258fe1b93904856da47ac78f4a322e88066b71e8ec207b07ef9545011fac239e9a1f4c611ba44636f4a2645e524936e14423026
SSDEEP

1536:ETUdFt1n6in6a81CxwpPWhmUMOEboKCNalJoIo:EaFyk0OE89alJoIo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b016ece0e51c1dc15bc35e121b131e1

Files

8b016ece0e51c1dc15bc35e121b131e1
.exe windows:4 windows x86 arch:x86

51f37b05bbde5be3f377c657c5ba1b2e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecA
PathAppendA
wnsprintfA

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
lstrcpyA
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
InitializeCriticalSection
InterlockedExchange
MultiByteToWideChar
SetStdHandle
LCMapStringW
LCMapStringA
GetSystemInfo
VirtualProtect
SetFilePointer
GetCPInfo
GetOEMCP
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetLastError
lstrlenA
FlushFileBuffers
CloseHandle
DeleteCriticalSection
HeapFree
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
ExitProcess
RtlUnwind
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
VirtualQuery
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte

user32

DialogBoxParamA
ShowWindow
EndDialog
SendMessageA
GetDesktopWindow
GetWindowRect
SetWindowPos
SetWindowTextA
GetDlgItem
LoadIconA

advapi32

RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51f37b05bbde5be3f377c657c5ba1b2e

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 40KB - Virtual size: 37KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 7KB

.shared Size: 4KB - Virtual size: 16B

.rsrc Size: 28KB - Virtual size: 27KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 7KB

.shared
Size: 4KB - Virtual size: 16B

.rsrc
Size: 28KB - Virtual size: 27KB