a7c78e084692653b863dde173370c39c45073f381b7bcbadc210d40f738d65db[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a7c78e084692653b863dde173370c39c45073f381b7bcbadc210d40f738d65db.exe
Size

393KB
MD5

d8c247f95b2784419ffc14c8df8efc07
SHA1

d6b40dfc8a232cec5d27371dd8a028da73eae151
SHA256

a7c78e084692653b863dde173370c39c45073f381b7bcbadc210d40f738d65db
SHA512

d2f9d70995aca04af2c693b957339f3b2b195af6d2a4867e6a36192eaf0d11bc557cf0774e8860fee8413680c12c1065597c2e948d448ae144e0e7b8d4b72fa4
SSDEEP

6144:YrBhJXzfQfEbJpAWMeOwGjBUmj/Og7niXEyad9RftJ3Pi/jkonq:YrBrjf2EbPAnwmDpniXEpfz3ujkonq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7c78e084692653b863dde173370c39c45073f381b7bcbadc210d40f738d65db.exe

Files

a7c78e084692653b863dde173370c39c45073f381b7bcbadc210d40f738d65db.exe
.exe windows:5 windows x86 arch:x86

1b595f958013dd275dc73bb0c0bac8d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\stem\Taking\strap\knives\Walber.pdb

Imports

kernel32

GetConsoleMode
GetConsoleCP
SetFilePointer
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
CreateNamedPipeA
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameA
GetStdHandle
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLastError
GetProcessHeap
HeapAlloc
CreateToolhelp32Snapshot
Process32Next
GetFileType
CloseHandle
GetOverlappedResult
GetProcAddress
GetConsoleWindow
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
lstrlenA
Sleep
FindFirstChangeNotificationA
WaitForSingleObject
FindCloseChangeNotification
CreateFileA
WriteFile
CreateDirectoryA
FindFirstFileA
lstrcpyA
lstrcatA
FindClose
GetModuleHandleA
FreeEnvironmentStringsW
LoadLibraryA
TerminateProcess
HeapFree
GetStartupInfoA
GetCommandLineA
RtlUnwind
RaiseException
ExitProcess
GetModuleHandleW

user32

PostQuitMessage
SetCapture
ClientToScreen
DrawTextA
SetRect
ReleaseCapture
GetDesktopWindow
SetDlgItemTextA
GetMenuItemCount
GetCursorInfo
SendDlgItemMessageW
FillRect
SetWindowLongA
GetClientRect
GetWindowRect
ScreenToClient
SendMessageA
InvalidateRgn
DefWindowProcA
LoadIconA
LoadCursorA
RegisterClassExA
InvalidateRect
DrawMenuBar
DefMDIChildProcA
GetWindowLongA
LoadBitmapA
GetMenu
SetMenuItemInfoA
BeginPaint
MoveWindow
GetParent
EndPaint
SetCursor
GetCursorPos
GetClassLongA
SetClassLongA
GetSystemMenu
EnableMenuItem
GetDlgItem
GetScrollPos
SetScrollPos
EndDialog
GetDC
ReleaseDC
SetScrollRange
GetSysColor
AppendMenuW
GetForegroundWindow
RedrawWindow
GetAsyncKeyState
keybd_event
MessageBoxA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
CreatePopupMenu

gdi32

GetStockObject
GetTextMetricsA
TextOutA
SetBkColor
CreateSolidBrush
SelectObject
FillPath
EnumFontsA
DeleteObject
FrameRgn
SelectClipRgn
CreateEllipticRgn
CombineRgn
StretchDIBits

advapi32

CredEnumerateA
RegDisablePredefinedCache

shell32

DragAcceptFiles
DragQueryFileA
DragFinish

ole32

CoCreateGuid
StringFromGUID2

psapi

GetProcessMemoryInfo

comctl32

ImageList_Create
ImageList_ReplaceIcon
ord17
ImageList_DragLeave
ImageList_EndDrag
InitCommonControlsEx
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragMove
ImageList_Destroy
ImageList_LoadImageA
CreateToolbarEx
ImageList_Draw
ord6

pdh

PdhOpenQueryW
PdhCloseQuery
PdhAddCounterW
PdhCollectQueryData

secur32

QuerySecurityPackageInfoA

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo

wtsapi32

WTSFreeMemory
WTSOpenServerA
WTSCloseServer
WTSQuerySessionInformationA
WTSEnumerateSessionsA

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pota
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b595f958013dd275dc73bb0c0bac8d8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

psapi

comctl32

pdh

secur32

setupapi

wtsapi32

Sections

.text Size: 91KB - Virtual size: 90KB

.rdata Size: 182KB - Virtual size: 182KB

.data Size: 6KB - Virtual size: 13KB

.pota Size: 24KB - Virtual size: 23KB

.rsrc Size: 88KB - Virtual size: 87KB

.text
Size: 91KB - Virtual size: 90KB

.rdata
Size: 182KB - Virtual size: 182KB

.data
Size: 6KB - Virtual size: 13KB

.pota
Size: 24KB - Virtual size: 23KB

.rsrc
Size: 88KB - Virtual size: 87KB