bc91020dfbdff14771ee6a875d7a476ef27b0a42bbde5371df858ed38085bf0a

Sharing

Copy URL Twitter E-mail

General

Target

bc91020dfbdff14771ee6a875d7a476ef27b0a42bbde5371df858ed38085bf0a
Size

400KB
MD5

557b748b5c26ddd209480f46754f23c7
SHA1

0d461565c5b39ad9c718eb0d4367f4a699886fde
SHA256

bc91020dfbdff14771ee6a875d7a476ef27b0a42bbde5371df858ed38085bf0a
SHA512

cdf56e15dc53b831aec48b38c6a58308c67078323170477befc167680291ee99edcbf69ee9b503d4c30b8f98b452d3daf24fd83f3ddcc4691c8c02d35748b652
SSDEEP

6144:EJEKzIHyRt1Yal1eKEKiuNTzJWJLoo6I467dDKbRYKtKMP4:PHyRt1YareKEKiuNgL/SbRZMMP4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc91020dfbdff14771ee6a875d7a476ef27b0a42bbde5371df858ed38085bf0a

Files

bc91020dfbdff14771ee6a875d7a476ef27b0a42bbde5371df858ed38085bf0a
.exe windows:6 windows x86 arch:x86

f6b984a5314c20a93a71b9e03317a152

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

BeginPaint
RegisterWindowMessageW
FindWindowA
PostQuitMessage
KillTimer
GetClassNameW
FindWindowW
TranslateMessage
ChangeWindowMessageFilter
GetWindowThreadProcessId
DefWindowProcW
GetMessageA
PostMessageW
DispatchMessageA
LoadCursorA
SetWindowPos
keybd_event
PostMessageA
CreateWindowExW
SendMessageW
RegisterClassExW
IsWindow
TranslateAcceleratorA
SetTimer
SetWindowsHookExA
LoadAcceleratorsA
SetMenu
UnhookWindowsHookEx
EndPaint

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance

oleaut32

VariantInit
VariantClear

kernel32

GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapAlloc
HeapFree
SetFilePointerEx
GetFileType
IsWow64Process2
GetCurrentProcess
WaitForSingleObject
OpenFileMappingW
OpenProcess
Sleep
CloseHandle
LoadLibraryW
K32EnumProcesses
SetCurrentDirectoryW
GetProcAddress
FreeLibrary
QueryFullProcessImageNameW
DeleteFileW
GetCurrentThreadId
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
GetCommandLineW
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
WriteConsoleW
GetModuleHandleW
GetCPInfo
SetStdHandle
WriteFile
GetStdHandle
GetModuleFileNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
CreateFileW
FlushFileBuffers
HeapSize
SetEndOfFile
ExitProcess
ReadFile
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue

shell32

ShellExecuteA
ShellExecuteW

advapi32

CreateServiceW
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
StartServiceW
OpenServiceW

virtdisk

OpenVirtualDisk
DetachVirtualDisk

shlwapi

PathFindExtensionW
PathRemoveBackslashW
PathRemoveFileSpecW

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6b984a5314c20a93a71b9e03317a152

Headers

DLL Characteristics

File Characteristics

Imports

user32

ole32

oleaut32

kernel32

shell32

advapi32

virtdisk

shlwapi

Sections

.text Size: 210KB - Virtual size: 210KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 100KB - Virtual size: 100KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 210KB - Virtual size: 210KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 100KB - Virtual size: 100KB

.reloc
Size: 10KB - Virtual size: 9KB