a273debb2dea9c1984e1186c9188d024

General

Target

a273debb2dea9c1984e1186c9188d024
Size

220KB
MD5

a273debb2dea9c1984e1186c9188d024
SHA1

e35a33c5ef632804d0540a7f9494a58f746ae17e
SHA256

d81ca0d28d1631d448fee682a3c58a63552f2bc9a3b4ee76d6539844590942ad
SHA512

1ca9fe8dc304ced3a7244f954158743dc13714358d8963da83b13c279a9359d8c07e1d856216920fdd8b08a20c9db5920ff6d1d02699f7f47aaf7ad93fc4dbb7
SSDEEP

3072:tRogPMlAbTyXhuhCl87bHUgMyfkMNhSljxRRDNGv5nE8dFNs90NlK0RFzyu:UeXJClwrUrzEI1RFsFE8dIAl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a273debb2dea9c1984e1186c9188d024

Files

a273debb2dea9c1984e1186c9188d024
.exe windows:4 windows x86 arch:x86

b54169fa715596290e921a7af3224969

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualLock
VirtualProtect
TerminateThread
OpenMutexA
OpenFileMappingA
Sleep
LoadLibraryA
GlobalLock
GetProcAddress
GetPriorityClass
GetModuleHandleA
CreateTimerQueue
ResetEvent
VirtualQuery
VirtualFree
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
InterlockedExchange
RtlUnwind
GetLastError
DeleteTimerQueue
HeapReAlloc
HeapAlloc
GetCPInfo
GetOEMCP
GetSystemInfo
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
GetACP

user32

GetDC
GetCursorPos
SetTimer
GetDesktopWindow
EnumChildWindows
CreateIcon
IsIconic
SetCursorPos
GetWindowRect
SetCursor
UpdateWindow
LoadIconA
LoadCursorA
ReleaseDC

gdi32

SetPixel
FloodFill

shell32

SHGetFolderPathA
SHCreateShellItem

psapi

EnumProcessModules

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b54169fa715596290e921a7af3224969

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

psapi

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 32KB - Virtual size: 33KB

.rsrc Size: 156KB - Virtual size: 153KB

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 32KB - Virtual size: 33KB

.rsrc
Size: 156KB - Virtual size: 153KB