a17a8852d47c71026e6845ac043d21f7

Sharing

Copy URL Twitter E-mail

General

Target

a17a8852d47c71026e6845ac043d21f7
Size

1.2MB
MD5

a17a8852d47c71026e6845ac043d21f7
SHA1

b900d518947dea063fa13c7c8687165a89c0f7fe
SHA256

27d1a8b6a00a5aaee754425a5fd894cb538187553f4caaa1827fce1a5ec14846
SHA512

6cb2cb11535def9ca766793e50af38fe8df69c4855778cce49fc3254f9dd34afa381fbfda395ab6320e8078357d5a3a76c40e6ff8dc53d7c413e9c47111d9262
SSDEEP

24576:oHmPZwqeMvE4JYO56msrwCoIjeS/phsB2/T4cRzr5aEa9xc9j5R+bbbbbGGmT:oUFcGYkqpP/pSo/sct5aEa9xc99JT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a17a8852d47c71026e6845ac043d21f7

Files

a17a8852d47c71026e6845ac043d21f7
.exe windows:4 windows x86 arch:x86

e24250d6a40673aa549dd9ec14b94478

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

LPSAFEARRAY_UserUnmarshal
VarBstrCat
VarR4FromUI1
VarBoolFromI4
VarI8FromI2
VarUI2FromI4
SafeArrayGetVartype
VarUI1FromI8
BSTR_UserSize
OleCreatePictureIndirect
VarBstrFromI1
VarDateFromUI1
VarBoolFromI2
VarUI1FromUI2
VarBstrFromI4

kernel32

GetSystemWow64DirectoryW
RestoreLastError
AttachConsole
GetTimeZoneInformation
GetVolumeInformationA
CreateDirectoryW
CreateHardLinkA
CreateFileMappingA
FlushFileBuffers
GetTempPathA
FindFirstVolumeMountPointA
GetModuleHandleA
UnregisterWait
IsBadStringPtrW
LoadLibraryA
SearchPathW
VirtualAlloc
GetEnvironmentVariableA
SetConsoleFont
LocalAlloc
SetPriorityClass
SetTapePosition
GetNamedPipeInfo
EnumCalendarInfoW

msacm32

acmStreamPrepareHeader
acmGetVersion
acmStreamReset
acmDriverRemove
acmFormatTagDetailsW
acmFilterTagEnumA
acmFormatChooseW
acmFilterChooseW
acmDriverAddA
acmDriverAddW
acmFormatDetailsA
acmFormatChooseA
acmDriverMessage
acmFormatTagDetailsA
acmMetrics
XRegThunkEntry

printui

DocumentPropertiesWrap
bFolderEnumPrinters
PrintNotifyTray_Exit
vQueueCreate
PnPInterface
vDocumentDefaults
PrinterPropPageProvider
PrintUIEntryW
PrintNotifyTray_Init
bFolderGetPrinter
bFolderRefresh
RegisterPrintNotify
bPrinterSetup
DllMain
ConnectToPrinterDlg

ntdll

RtlImageRvaToVa
NtFlushWriteBuffer
ZwQueryTimer
NtContinue
ZwQuerySystemTime
RtlPushFrame
RtlSetAttributesSecurityDescriptor
ceil
DbgUiConnectToDbg
qsort
_strnicmp
CsrCaptureTimeout
LdrVerifyImageMatchesChecksum
RtlDecompressFragment
RtlInitializeResource

iphlpapi

GetInterfaceInfo
GetIpAddrTable
IcmpParseReplies
InternalSetIpForwardEntry
InternalCreateIpForwardEntry
GetIpNetTable
RestoreMediaSense
IcmpCreateFile
_PfSetLogBuffer@28
CreateProxyArpEntry
do_echo_req
GetTcpStatistics
GetIfTable
IcmpSendEcho
DisableMediaSense
GetBestRoute
GetUdpTable
InternalSetIpStats
SetAdapterIpAddress
AddIPAddress
do_echo_rep
Icmp6SendEcho2

Sections

.text
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 311KB - Virtual size: 1023KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e24250d6a40673aa549dd9ec14b94478

Headers

File Characteristics

Imports

oleaut32

kernel32

msacm32

printui

ntdll

iphlpapi

Sections

.text Size: 484KB - Virtual size: 483KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 311KB - Virtual size: 1023KB

.rsrc Size: 6KB - Virtual size: 6KB

.text
Size: 484KB - Virtual size: 483KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 311KB - Virtual size: 1023KB

.rsrc
Size: 6KB - Virtual size: 6KB