31ebab56287c8398fddf93d8becc029f6c6265a95c063e23290caa151fa0f35e[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

31ebab56287c8398fddf93d8becc029f6c6265a95c063e23290caa151fa0f35e.exe
Size

169KB
MD5

d9d19b10149ddf9c56ca2d12efda93ae
SHA1

afac03d80949e51c3dddffda4871a1a6d2a21d48
SHA256

31ebab56287c8398fddf93d8becc029f6c6265a95c063e23290caa151fa0f35e
SHA512

9d2f7c794e8bccb473f32e9ffb0eecd3d052bfc1697c497f7a9487703803e002c40c384fdd4761f91057de815d008f9b0df0865c3ee96aab62c36cd4659ab352
SSDEEP

3072:JotUYlwyOGPgWdyxI90h08Rf/+yfegiAOmCdIBPgvgeWZ:JotU52Pgbu978R+yfsA0dIBI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31ebab56287c8398fddf93d8becc029f6c6265a95c063e23290caa151fa0f35e.exe

Files

31ebab56287c8398fddf93d8becc029f6c6265a95c063e23290caa151fa0f35e.exe
.exe windows:6 windows x64 arch:x64

92268c931893a05087280b3173af69c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

strcmp
_snprintf
_errno
memset
_vsnprintf
_strtoi64
memchr
_time64
strncpy
strchr
strtod
localeconv
_vsnwprintf
qsort
atol
memcpy

kernel32

SetFileAttributesW
GetTickCount
SetThreadPriority
FlushFileBuffers
LocalAlloc
GetExitCodeProcess
GetFileAttributesW
GetModuleHandleA
SetCurrentDirectoryA
Sleep
lstrcmpiW
GetDriveTypeW
GetLastError
CreateDirectoryW
lstrcatA
lstrcmpA
CreateMutexW
GetCurrentThread
GetProcessId
GetNumberFormatA
DisconnectNamedPipe
MoveFileW
ExitThread
GetCurrentProcessId
SwitchToThread
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
LoadLibraryA
GetCurrentProcess
MultiByteToWideChar
lstrcatW
WideCharToMultiByte
FindFirstFileW
FindNextFileW
GetSystemTimeAsFileTime
lstrlenW
LoadLibraryW
FreeLibrary
GetCommandLineW
GetVersionExA
GetSystemInfo
GetCurrentDirectoryW
GetWindowsDirectoryW

user32

CharUpperBuffA
CharUpperBuffW

shell32

CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

SafeArrayGetLBound
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayDestroy
VariantClear
SysFreeString
SysAllocString

Sections

.text
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92268c931893a05087280b3173af69c3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

shell32

ole32

oleaut32

Sections

.text Size: 129KB - Virtual size: 128KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 17KB

.pdata Size: 5KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 68B

.text
Size: 129KB - Virtual size: 128KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 17KB

.pdata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 68B