3966552c636e805da64eed10010a28aba15cb3d81310edaf38f903ca7d06ee80

Sharing

Copy URL Twitter E-mail

General

Target

3966552c636e805da64eed10010a28aba15cb3d81310edaf38f903ca7d06ee80
Size

465KB
MD5

ca8e6faaeda73812ce81f09511168ce1
SHA1

fa4ed9271322830cf4192ab747036a5b59f58f80
SHA256

3966552c636e805da64eed10010a28aba15cb3d81310edaf38f903ca7d06ee80
SHA512

1236fa7b78c2e0db91e1ce7033b8b8b0f4ab65c4c012434e15fbe84c055cfe6293edcea4b8f28659ef7143b1036bb9f77bcc16395daec9cbae5bcc07d83ddee5
SSDEEP

6144:2VUtkRjEosmQ5m8IvNLXZ362WP4KLzReZTa55z4Aea37FeDLsOavLVRP90e:2VUtkGNV8PulpwZTanL74DL8530e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3966552c636e805da64eed10010a28aba15cb3d81310edaf38f903ca7d06ee80

Files

3966552c636e805da64eed10010a28aba15cb3d81310edaf38f903ca7d06ee80
.exe windows:5 windows x86 arch:x86

06795e7a4243010ba1cddcdd6acb03bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToTzSpecificLocalTime
HeapAlloc
SystemTimeToFileTime
CreateDirectoryW
SetEvent
FreeEnvironmentStringsA
GetTickCount
GetConsoleAliasesA
GetConsoleAliasesLengthA
LoadLibraryW
AssignProcessToJobObject
ReplaceFileW
FlushFileBuffers
GetCurrentDirectoryW
WriteConsoleOutputCharacterA
lstrcmpiA
GetProcAddress
CreateNamedPipeA
LoadLibraryA
LocalAlloc
SetProcessWorkingSetSize
AddAtomA
EnumDateFormatsA
EraseTape
VirtualProtect
CompareStringA
FatalAppExitA
IsValidLocale
EnumSystemLocalesA
SetLastError
GetComputerNameA
GetLocaleInfoA
GetUserDefaultLCID
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
HeapReAlloc
IsProcessorFeaturePresent
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointer
CloseHandle
WriteConsoleW
SetStdHandle
CreateFileW
RaiseException

user32

GetClassLongW

advapi32

AccessCheckByType

ole32

CreateDataCache

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 39.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kiw
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06795e7a4243010ba1cddcdd6acb03bf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

Sections

.text Size: 334KB - Virtual size: 334KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 39.7MB

.tls Size: 2KB - Virtual size: 2KB

.kiw Size: 1024B - Virtual size: 1024B

.rsrc Size: 104KB - Virtual size: 103KB

.text
Size: 334KB - Virtual size: 334KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 39.7MB

.tls
Size: 2KB - Virtual size: 2KB

.kiw
Size: 1024B - Virtual size: 1024B

.rsrc
Size: 104KB - Virtual size: 103KB