8f23ba96626a32da8fcda13d752fec15

Sharing

Copy URL Twitter E-mail

General

Target

8f23ba96626a32da8fcda13d752fec15
Size

96KB
MD5

8f23ba96626a32da8fcda13d752fec15
SHA1

dd6c434d50b17ef8efd4c85e966e020d0923cad9
SHA256

7d671fef9ed2dc7b2b2406027b5f805782898aeca0049e4aea4137eccf627ba9
SHA512

9d14a785df06cf5480618f8532fc1369bf2e6f03395603e38644be1b24777c37e4918011886a3b526ad8fa4d26ee55fe014631ac3e285109adf785ffc177c60a
SSDEEP

1536:n72GRANBewprmwtIFYzzBrsp5YYWUtCoOeTgqO5i4hTChhhh5nS/cyelHu+6O:72GC5IFYvBooYWECoOeTgqO5i4hTChhQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f23ba96626a32da8fcda13d752fec15

Files

8f23ba96626a32da8fcda13d752fec15
.exe windows:6 windows x64 arch:x64

ce1a36a2a999517ca9b1c36df3b7e240

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WMPNSCFG.pdb

Imports

msvcrt

??_V@YAXPEAX@Z
??3@YAXPEAX@Z
memcpy_s
memmove_s
free
malloc
??2@YAPEAX_K@Z
wcsncpy_s
??_U@YAPEAX_K@Z
memset
__C_specific_handler
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
realloc
_errno
_CxxThrowException
__CxxFrameHandler3
memcmp

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

advapi32

ConvertSidToStringSidW
LookupAccountNameW
CopySid
OpenSCManagerW
CloseServiceHandle
OpenServiceW
RegQueryValueExW
QueryServiceConfigW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey

kernel32

LocalFree
OutputDebugStringA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DelayLoadFailureHook
LoadLibraryExA
GetCurrentThreadId
SetEvent
OpenEventW
FindResourceExW
LockResource
HeapSetInformation
RegisterApplicationRestart
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
EnterCriticalSection
RaiseException
GetLastError
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
FreeLibrary
lstrlenW
GetProcAddress
LoadLibraryW
GetModuleHandleW

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ce1a36a2a999517ca9b1c36df3b7e240

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

advapi32

kernel32

Sections

.text Size: 37KB - Virtual size: 37KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 28KB - Virtual size: 29KB

.text
Size: 37KB - Virtual size: 37KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 28KB - Virtual size: 29KB