b085f8c891c5f3c3292b318cbe63c6d01a07909964a3a7f9046def847bd94537

Sharing

Copy URL Twitter E-mail

General

Target

b085f8c891c5f3c3292b318cbe63c6d01a07909964a3a7f9046def847bd94537
Size

1.8MB
MD5

39e8ce603f4c93561230fa57539f0d3a
SHA1

16142ac8367adb5c4c76d9ad903744b8bb7e8c7e
SHA256

b085f8c891c5f3c3292b318cbe63c6d01a07909964a3a7f9046def847bd94537
SHA512

6653c164577c9166302650fc98309a1d6e69fe6f396e308c33951d525a800a9999c3ccd09a0d279d97e48580dc90293112a5b17797669e9c8b6eedf0d314b1a7
SSDEEP

24576:pLggggMuLMZV9cJlznJe3CpQTkZc1ntJv:pggggMEUcXJ8IQgZmt9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b085f8c891c5f3c3292b318cbe63c6d01a07909964a3a7f9046def847bd94537

Files

b085f8c891c5f3c3292b318cbe63c6d01a07909964a3a7f9046def847bd94537
.exe windows:5 windows x86 arch:x86

0f4a8058effcec41d36307d8b4502692

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\hudson\jobs\BestZip_1.0.1.210705\workspace\BestZip\Software\BestZip\Bin\Release\Md5Tool.pdb

Imports

kernel32

EnterCriticalSection
GetCurrentThreadId
FindFirstFileW
FindClose
FindNextFileW
GetFileTime
FileTimeToSystemTime
CreateThread
TerminateThread
GetVersionExW
GetLongPathNameW
SetLastError
lstrcmpiW
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
Sleep
GetTickCount
LocalAlloc
LocalFree
OpenProcess
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetLogicalDriveStringsW
CreateDirectoryW
LeaveCriticalSection
GetModuleHandleW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
WaitForSingleObject
GetFileSize
WriteFile
ReadFile
CreateFileW
CloseHandle
GetCommandLineW
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
SizeofResource
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
FindFirstFileExW
LCMapStringW
GetStringTypeW
GetFileType
GetCurrentThread
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
GetCommandLineA
InterlockedFlushSList
RtlUnwind
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
TryEnterCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree

user32

IsDialogMessageW
PostMessageW
ShowWindow
MapWindowPoints
GetClientRect
GetParent
GetWindowRect
GetMonitorInfoW
GetWindowTextLengthW
EnableWindow
SetWindowTextW
SendMessageW
GetDlgItem
UnregisterClassW
SetWindowPos
MonitorFromWindow
CreateDialogParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
DestroyWindow
PostQuitMessage
GetWindowTextA
SetWindowLongW
SetTimer
IsWindow
SetFocus
GetWindowTextW
KillTimer
GetSystemMetrics
LoadImageW
GetWindow
GetWindowLongW

gdi32

GetStockObject
GetObjectW
CreateFontIndirectW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
GetUserNameW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW

shell32

SHGetFolderPathW
DragFinish
DragQueryFileW
CommandLineToArgvW
DragAcceptFiles

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAddBackslashW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetProcessImageFileNameW
EnumProcesses

Sections

.text
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0f4a8058effcec41d36307d8b4502692

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

Sections

.text Size: 289KB - Virtual size: 288KB

.rdata Size: 86KB - Virtual size: 86KB

.data Size: 8KB - Virtual size: 20KB

.rsrc Size: 226KB - Virtual size: 226KB

.reloc Size: 79KB - Virtual size: 80KB

.text
Size: 289KB - Virtual size: 288KB

.rdata
Size: 86KB - Virtual size: 86KB

.data
Size: 8KB - Virtual size: 20KB

.rsrc
Size: 226KB - Virtual size: 226KB

.reloc
Size: 79KB - Virtual size: 80KB