a19ee76b05dfca5cb7f706d23c6216b4

Sharing

Copy URL Twitter E-mail

General

Target

a19ee76b05dfca5cb7f706d23c6216b4
Size

60KB
MD5

a19ee76b05dfca5cb7f706d23c6216b4
SHA1

2a3a288b7cfa4519aa15ecc30861551e21f7d3c9
SHA256

4ea4cd37c87cfdb31151dd4bfbc878f7768cf3c6cbdd6d0c98f68eafeb6b09a8
SHA512

8b291dd2825ca356a982212108ebc4b0ba87c2974f98c0a20cf82d628a1e8fb0050970d3c34a8b7bc1e04c97fb29917ee32452ba8475643b05b0949874094ca7
SSDEEP

1536:7yhOQDJ8lz2zvHBYgx+QqFUhfxyQUdLUyDv1H3A:7lMJfBYgxLgUhZyQgLUyDvZA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a19ee76b05dfca5cb7f706d23c6216b4

Files

a19ee76b05dfca5cb7f706d23c6216b4
.exe windows:4 windows x86 arch:x86

f4bf03e0f4428070681a3770182490a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegEnumKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegSetValueExA

shlwapi

StrStrIA
wnsprintfA
StrStrA

ws2_32

closesocket
socket
send
setsockopt
WSAStartup
htons
getsockname
sendto
recvfrom
recv
htonl
WSAGetLastError
WSASetLastError
inet_addr
getsockopt
inet_ntoa
gethostbyname
connect

kernel32

RtlUnwind
InterlockedExchange
GetOverlappedResult
MultiByteToWideChar
GlobalAlloc
GlobalFree
lstrcmpW
GetSystemTime
GetEnvironmentVariableA
CreateProcessA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CreateFileA
DeviceIoControl
GetCommandLineA
GetVersion
MapViewOfFile
CreateFileMappingA
CreateThread
GetCurrentThreadId
CreateMutexA
CloseHandle
OpenMutexA
Sleep
ExitProcess
ExitThread
TerminateThread
OpenThread
lstrcmpA
lstrlenW
IsBadReadPtr
lstrcmpiA
GetTickCount
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
IsBadWritePtr
WaitForSingleObject
ReleaseMutex
SystemTimeToFileTime
GetTimeZoneInformation
GetLastError
VirtualQuery

user32

wsprintfA
GetDC
CharLowerA

dnsapi

DnsQuery_A
DnsExtractRecordsFromMessage_W
DnsRecordListFree

gdiplus

GdipDeleteGraphics
GdipGetFontCollectionFamilyCount
GdipNewPrivateFontCollection
GdipPrivateAddMemoryFont
GdipDeleteFont
GdipDeletePen
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipSaveImageToStream
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetDC
GdipReleaseDC
GdipDrawLineI
GdipFillRectangleI
GdipDrawString
GdipDrawImageI
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipCreateFont
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneImage
GdipCreatePen1
GdipDeleteBrush
GdipFree
GdipAlloc
GdipLoadImageFromStream

gdi32

GetTextExtentPoint32A

ole32

CreateStreamOnHGlobal

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 21.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f4bf03e0f4428070681a3770182490a9

Headers

File Characteristics

Imports

advapi32

shlwapi

ws2_32

kernel32

user32

dnsapi

gdiplus

gdi32

ole32

Sections

.text Size: 57KB - Virtual size: 57KB

.data Size: 2KB - Virtual size: 21.7MB

.text
Size: 57KB - Virtual size: 57KB

.data
Size: 2KB - Virtual size: 21.7MB