a3f0158e8130c5209ba4cbe22d3b58d5

Sharing

Copy URL Twitter E-mail

General

Target

a3f0158e8130c5209ba4cbe22d3b58d5
Size

455KB
MD5

a3f0158e8130c5209ba4cbe22d3b58d5
SHA1

2bc5486d6ca04c8e9312f6e1c86106272953e68f
SHA256

b547602a24b47f4aba896fedb412a7f6d95fdf492aa2fa67fb28b90e17ef55bd
SHA512

bc170a000dba02af838d6361611673ec9acce6f69f6fa2303b0b92703f3ce8be3c09a10406dc906ec7804419a6d81d873f6f34287eb1748239354a36bd945f7b
SSDEEP

12288:e80KUQygU9nT7c8Gaew74e+27cGMN4zXUvwVcjFC:eVRQygUvGaew7n+fGMN4zXUDF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3f0158e8130c5209ba4cbe22d3b58d5

Files

a3f0158e8130c5209ba4cbe22d3b58d5
.exe windows:5 windows x86 arch:x86

7fb2c7efe5b5ca95d73455ebd2101814

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wtoi
wcslen
wcscat
_wcsnicmp
wcsstr
free
_initterm
malloc
_adjust_fdiv

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
GetProcessHeap
HeapFree
DeleteCriticalSection
CloseHandle
ExpandEnvironmentStringsW
WaitForSingleObject
GetSystemTimeAsFileTime
lstrlenW
GetProcAddress
LoadLibraryW
SwitchToThread
InterlockedExchange
QueueUserAPC
DisableThreadLibraryCalls
GetLastError
LoadLibraryExW
FreeLibrary
CompareStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount

netsh.exe

MatchTagsInCmdLine
MatchEnumTag
PrintMessageFromModule
RegisterContext
RegisterHelper

ole32

CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc
StringFromGUID2
CoUninitialize

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcBindingFree

rtutils

TraceRegisterExA
TraceDeregisterW
TraceVprintfExA

user32

LoadStringW

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.p102
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.0x9a9
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kalqo
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.88111
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9102
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1827
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7382
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.81721
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ajdiw
Size: 512B - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.09a
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.09a5
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.09a6
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.11524
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9a9s
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.a4a4
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fb2c7efe5b5ca95d73455ebd2101814

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

netsh.exe

ole32

oleaut32

rpcrt4

rtutils

user32

Sections

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 2KB

.p102 Size: 512B - Virtual size: 186B

.0x9a9 Size: 512B - Virtual size: 186B

.kalqo Size: 512B - Virtual size: 186B

.88111 Size: 512B - Virtual size: 186B

.9102 Size: 512B - Virtual size: 392B

.1827 Size: 512B - Virtual size: 186B

.7382 Size: 512B - Virtual size: 186B

.81721 Size: 200KB - Virtual size: 200KB

.ajdiw Size: 512B - Virtual size: 194B

.09a Size: 512B - Virtual size: 208B

.09a5 Size: 512B - Virtual size: 216B

.09a6 Size: 512B - Virtual size: 186B

.11524 Size: 512B - Virtual size: 158B

.9a9s Size: 200KB - Virtual size: 200KB

.a4a4 Size: 512B - Virtual size: 158B

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 276B

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 2KB

.p102
Size: 512B - Virtual size: 186B

.0x9a9
Size: 512B - Virtual size: 186B

.kalqo
Size: 512B - Virtual size: 186B

.88111
Size: 512B - Virtual size: 186B

.9102
Size: 512B - Virtual size: 392B

.1827
Size: 512B - Virtual size: 186B

.7382
Size: 512B - Virtual size: 186B

.81721
Size: 200KB - Virtual size: 200KB

.ajdiw
Size: 512B - Virtual size: 194B

.09a
Size: 512B - Virtual size: 208B

.09a5
Size: 512B - Virtual size: 216B

.09a6
Size: 512B - Virtual size: 186B

.11524
Size: 512B - Virtual size: 158B

.9a9s
Size: 200KB - Virtual size: 200KB

.a4a4
Size: 512B - Virtual size: 158B

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 276B