a5f0a2d3704af759776bbde8adf798881ce0dcefacde3a9bc94ae9448e1b6b06

Sharing

Copy URL Twitter E-mail

General

Target

a5f0a2d3704af759776bbde8adf798881ce0dcefacde3a9bc94ae9448e1b6b06
Size

400KB
MD5

92fc28a9c7923828c4466cc780ea723d
SHA1

dff4c25597e8fa2aef24e4dd16ad0970618d006f
SHA256

a5f0a2d3704af759776bbde8adf798881ce0dcefacde3a9bc94ae9448e1b6b06
SHA512

85dc45c89923eab4a0f729a6c897614f7a50184aa6de4a222d24b663f8baac03b34cffd5c85fe240d900ad65e1956a3e3d153da2e424270f896934af18948693
SSDEEP

6144:qJEKzIHyRt1Yal1eKEKiuNTzJWJLoo6I46bduKbRYKtKMP4:1HyRt1YareKEKiuNgL/1bRZMMP4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5f0a2d3704af759776bbde8adf798881ce0dcefacde3a9bc94ae9448e1b6b06

Files

a5f0a2d3704af759776bbde8adf798881ce0dcefacde3a9bc94ae9448e1b6b06
.exe windows:6 windows x86 arch:x86

f6b984a5314c20a93a71b9e03317a152

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
RegisterWindowMessageW
FindWindowA
PostQuitMessage
KillTimer
GetClassNameW
FindWindowW
TranslateMessage
ChangeWindowMessageFilter
GetWindowThreadProcessId
DefWindowProcW
GetMessageA
PostMessageW
DispatchMessageA
LoadCursorA
SetWindowPos
keybd_event
PostMessageA
CreateWindowExW
SendMessageW
RegisterClassExW
IsWindow
TranslateAcceleratorA
SetTimer
SetWindowsHookExA
LoadAcceleratorsA
SetMenu
UnhookWindowsHookEx
EndPaint

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance

oleaut32

VariantInit
VariantClear

kernel32

GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapAlloc
HeapFree
SetFilePointerEx
GetFileType
IsWow64Process2
GetCurrentProcess
WaitForSingleObject
OpenFileMappingW
OpenProcess
Sleep
CloseHandle
LoadLibraryW
K32EnumProcesses
SetCurrentDirectoryW
GetProcAddress
FreeLibrary
QueryFullProcessImageNameW
DeleteFileW
GetCurrentThreadId
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
GetCommandLineW
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
WriteConsoleW
GetModuleHandleW
GetCPInfo
SetStdHandle
WriteFile
GetStdHandle
GetModuleFileNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
CreateFileW
FlushFileBuffers
HeapSize
SetEndOfFile
ExitProcess
ReadFile
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue

shell32

ShellExecuteA
ShellExecuteW

advapi32

CreateServiceW
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
StartServiceW
OpenServiceW

virtdisk

OpenVirtualDisk
DetachVirtualDisk

shlwapi

PathFindExtensionW
PathRemoveBackslashW
PathRemoveFileSpecW

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6b984a5314c20a93a71b9e03317a152

Headers

DLL Characteristics

File Characteristics

Imports

user32

ole32

oleaut32

kernel32

shell32

advapi32

virtdisk

shlwapi

Sections

.text Size: 210KB - Virtual size: 210KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 100KB - Virtual size: 100KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 210KB - Virtual size: 210KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 100KB - Virtual size: 100KB

.reloc
Size: 10KB - Virtual size: 9KB