d9f63c340ccb6bd0a01914f68a4b971a361788b4e2a12c77bebc627d6a6c7c3f

Sharing

Copy URL Twitter E-mail

General

Target

d9f63c340ccb6bd0a01914f68a4b971a361788b4e2a12c77bebc627d6a6c7c3f
Size

13.5MB
MD5

5263576b9fa67e27a0a74cb084b130fd
SHA1

2b9f4afe54bea9b8c7d0ff540e1de81ae0d33924
SHA256

d9f63c340ccb6bd0a01914f68a4b971a361788b4e2a12c77bebc627d6a6c7c3f
SHA512

b97d5b9c0524776cbb900e3b40593fbc7fab43cfc81d911a14adbfa69da359811235b0ba7f52239929d9a6b2df88a11d459f386190a9dd38446feb4cd133516d
SSDEEP

196608:cG9fHw1f1R3LV0/ff+7mF3LRKuaae1uTN+o2DVvQCU6qgKCiuWsrrDEOEZz7V93W:cG9fHcf1BLVGN4jJ4AoeJQCrKCu92+M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9f63c340ccb6bd0a01914f68a4b971a361788b4e2a12c77bebc627d6a6c7c3f

Files

d9f63c340ccb6bd0a01914f68a4b971a361788b4e2a12c77bebc627d6a6c7c3f
.exe windows:4 windows x86 arch:x86

7576c9f124ab5275b95b58fb328371a6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx

user32

wsprintfA

shlwapi

ord158

msvbvm60

__vbaVarTstGt
__vbaStrI2
__vbaI2Sgn
__vbaStrVarMove
__vbaRecAnsiToUni
__vbaI4Sgn
__vbaVarTextTstEq
__vbaStrDate
__vbaNameFile
__vbaVargVarCopy
__vbaLenVar
__vbaLateMemSt
__vbaStrBool
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
__vbaStrFixstr
__vbaStrTextCmp
__vbaRefVarAry
ord631
__vbaErase
__vbaLateMemStAd
__vbaVarAbs
__vbaVarLateMemSt
__vbaNew
_CIsqrt
__vbaStrUI1
ord712
__vbaR4ErrVar
_adj_fprem
__vbaI2Str
ord608
__vbaVarCmpLe
__vbaFPException
__vbaInStrVar
__vbaUbound
__vbaVarCat
__vbaDateVar
__vbaLsetFixstrFree
ord645
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaNew2
_adj_fdiv_m32i
__vbaI4Str
__vbaVarNot
_adj_fdivr_m32
__vbaVarTstNe
__vbaForEachAry
__vbaLateMemCall
__vbaVarDup
__vbaFpI2
__vbaRecDestructAnsi
_CIatan
__vbaCastObj
__vbaStrVarCopy
__vbaForEachVar
__vbaVarNeg
ord650
__vbaVarLateMemCallSt
__vbaAryRecCopy
__vbaFPInt

Sections

.text
Size: - Virtual size: 13.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox
Size: - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vdata0
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vdata1
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox3
Size: 216KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7576c9f124ab5275b95b58fb328371a6

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

msvbvm60

Sections

.text Size: - Virtual size: 13.1MB

.data Size: - Virtual size: 278KB

.virbox Size: - Virtual size: 7.4MB

.vdata0 Size: - Virtual size: 8.3MB

.vdata1 Size: - Virtual size: 20KB

.virbox3 Size: 216KB - Virtual size: 212KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: - Virtual size: 13.1MB

.data
Size: - Virtual size: 278KB

.virbox
Size: - Virtual size: 7.4MB

.vdata0
Size: - Virtual size: 8.3MB

.vdata1
Size: - Virtual size: 20KB

.virbox3
Size: 216KB - Virtual size: 212KB

.rsrc
Size: 4KB - Virtual size: 2KB