8cfa6721e76eead22e40e891747f56de

Sharing

Copy URL Twitter E-mail

General

Target

8cfa6721e76eead22e40e891747f56de
Size

31KB
MD5

8cfa6721e76eead22e40e891747f56de
SHA1

dc593819116dade4deea4e717135f7b38018c3da
SHA256

3ec8633710c861d9f194c88f1907da9cc7dab593966f7a5fe070370f5c7d0047
SHA512

0bea9cba54bfb2c685d04a593b462ab4b9bc39b3a08e610d570ef6e6563fdc4c59c696bff5802fd639b74e01753788786f8b7166bf0c5491a0d8192693511288
SSDEEP

768:r/3202sV1bstU1j/gS1sl7LIoyCCQNlzs3:r/3/V1bstU1jv4ooyGrzs3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8cfa6721e76eead22e40e891747f56de

Files

8cfa6721e76eead22e40e891747f56de
.exe windows:4 windows x86 arch:x86

7e6cbf04d8d7666864645f7563622e61

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CreateStreamOnHGlobal
CoTaskMemFree

kernel32

GetTempPathA
CreateToolhelp32Snapshot
DeleteFileA
CloseHandle
lstrlenW
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
WriteFile
WideCharToMultiByte
UnmapViewOfFile
TerminateProcess
Sleep
SetFilePointer
CompareStringA
CopyFileA
CreateDirectoryA
CreateFileA
CreateFileMappingA
RtlMoveMemory
RemoveDirectoryA
ReadFile
Process32Next
Process32First
OpenProcess
MultiByteToWideChar
MoveFileA
MapViewOfFile
LocalFree
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
ExitProcess
GetSystemDirectoryA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFileSize
GetFileAttributesA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateThread

user32

wsprintfA
GetDC
ReleaseDC

advapi32

ChangeServiceConfigA
GetUserNameA
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
RegCreateKeyA
RegCloseKey
OpenServiceA
OpenSCManagerA
OpenProcessToken
LookupPrivilegeValueA
CloseServiceHandle
ControlService
AdjustTokenPrivileges

shlwapi

StrRChrA
StrStrIA
StrChrA
StrCmpNA

shell32

ShellExecuteA

wsock32

socket
send
recv
listen
inet_addr
htons
getsockname
gethostname
gethostbyname
connect
closesocket
bind
accept
WSAStartup

rasapi32

RasEnumEntriesA
RasGetEntryPropertiesA
RasGetEntryDialParamsA

gdi32

GetDeviceCaps

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7e6cbf04d8d7666864645f7563622e61

Headers

File Characteristics

Imports

ole32

kernel32

user32

advapi32

shlwapi

shell32

wsock32

rasapi32

gdi32

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 6KB - Virtual size: 171KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 6KB - Virtual size: 171KB