8f18b5b0c49023f0d2b8f218e87c70b7

Sharing

Copy URL Twitter E-mail

General

Target

8f18b5b0c49023f0d2b8f218e87c70b7
Size

112KB
MD5

8f18b5b0c49023f0d2b8f218e87c70b7
SHA1

4fb50dd1f56b7355c5f6f11154218c0d1c177009
SHA256

be884ada20fe95702aef6c34c41a2af91ceae5e458b05b9afbfc41dafd8056a1
SHA512

094cde57de30f565c9fcccc4f1831571db2ed477e8005c338f6b304471c73e0a29b53b5a39dab2c926478b7359810c10ed19a66ca9094bd6c1de1e6008c66acf
SSDEEP

1536:XloS3/l1sXoQpUaJpPAS7IkcCaQNgqNAaJ8iskopuCG:Xt3/l1sXtWEpPKkcvKvJ+koUCG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f18b5b0c49023f0d2b8f218e87c70b7

Files

8f18b5b0c49023f0d2b8f218e87c70b7
.exe windows:4 windows x86 arch:x86

8156c318fc16406380eab2829df4abe9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetLastError
Sleep
ReadFile
CreateFileA
DeviceIoControl
GetModuleHandleA
CreateDirectoryA
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
SetEndOfFile
SetStdHandle
IsBadCodePtr
GetSystemDirectoryA
GetShortPathNameA
GetVolumeInformationA
OpenMutexA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
GetFileAttributesA
DeleteFileA
CreateProcessA
WaitForSingleObject
CloseHandle
SetFileAttributesA
CopyFileA
GetLogicalDriveStringsA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GetWindowsDirectoryA
IsBadReadPtr
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetFilePointer
IsBadWritePtr
VirtualAlloc
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
LCMapStringA
LCMapStringW
GetCPInfo
HeapSize
GetACP
GetOEMCP
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
WriteFile

advapi32

ControlService
RegEnumValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
DeleteService
StartServiceA
QueryServiceStatus
CreateServiceA
ChangeServiceConfig2A
RegCreateKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeregisterEventSource
GetUserNameA
CreateProcessAsUserA
OpenProcessToken
RegOpenKeyExA
RegCloseKey

ole32

CoUninitialize
CoGetClassObject
StringFromCLSID
CoInitialize

oleaut32

VariantClear

Sections

.text
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8156c318fc16406380eab2829df4abe9

Headers

File Characteristics

Imports

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 84KB - Virtual size: 82KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 84KB - Virtual size: 82KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 1KB