a122649fabeeeb5b8cb47891f9ad455d

Sharing

Copy URL Twitter E-mail

General

Target

a122649fabeeeb5b8cb47891f9ad455d
Size

28KB
MD5

a122649fabeeeb5b8cb47891f9ad455d
SHA1

7b4b986704da66beb16240aa693dbea223d4d91d
SHA256

75f06a86feb01820b272c4642a23959998fc5535bf53b88fbcc618ef8ad4db8e
SHA512

a8f211b84dcf7d6074cbca4cb8fb8bb0d6313cd3161612a01ac1643b2ebe0c6de0e1c04dc71f2f4b49abdc04332a6d7fd66dd0fe57b2e11e699e83dff055d6d2
SSDEEP

768:oIeZ26Q+4el77GXESf9U99elBeUFfo6ZBxFlqdsm:oIeZ2K4q4j9U9IdfhBQem

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a122649fabeeeb5b8cb47891f9ad455d

Files

a122649fabeeeb5b8cb47891f9ad455d
.exe windows:4 windows x86 arch:x86

42381672eb500aa0d0368e764ebfea92

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSAStartup
WSACleanup
ioctlsocket
gethostbyname

shlwapi

SHDeleteKeyA

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

kernel32

HeapAlloc
GetProcessHeap
OutputDebugStringA
lstrcmpiA
lstrcpyA
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
HeapFree
lstrcatA
lstrlenA
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
Sleep
PulseEvent
CreateThread
GetTickCount
GetCurrentThreadId
UnmapViewOfFile
WaitForSingleObject
GetLastError
CreateEventA
lstrcmpA
FreeLibrary
LoadLibraryA
lstrcpynA
CloseHandle
OpenEventA
MapViewOfFileEx
CreateFileMappingA
VirtualAlloc
VirtualFree
GetProcAddress
VirtualProtect
HeapReAlloc
SetThreadContext
FlushInstructionCache
WriteProcessMemory
VirtualProtectEx
GetThreadContext
ResumeThread
DuplicateHandle
CreateRemoteThread
OpenProcess
CreateProcessA
GetCurrentProcess
GetVersionExA
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAllocEx
IsBadReadPtr
VirtualQuery
OpenFile
SetFileTime
GetFileTime
CreateFileA
GetFileAttributesA
GetSystemDirectoryA
DeleteFileA
WinExec
GetWindowsDirectoryA
CopyFileA
MapViewOfFile
SetLastError
RemoveDirectoryA
ExitProcess
TerminateThread
GetCurrentThread

user32

TranslateMessage
MessageBoxA
GetMessageA
DispatchMessageA
wsprintfA

advapi32

GetTokenInformation
RegDeleteValueA
RegCreateKeyExA
RegEnumValueA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
RegCloseKey
AdjustTokenPrivileges
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

wininet

InternetCrackUrlA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCanonicalizeUrlA
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoA

Exports

Exports

StartDownload
_WorkProc@4
__mp@4

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

42381672eb500aa0d0368e764ebfea92

Headers

File Characteristics

Imports

wsock32

shlwapi

rpcrt4

kernel32

user32

advapi32

shell32

wininet

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 24KB

.reloc Size: 2KB - Virtual size: 1KB

Size: 512B - Virtual size: 4KB

.text
Size: 25KB - Virtual size: 24KB

.reloc
Size: 2KB - Virtual size: 1KB