a3f5325ad694c5971745b5c2f689b255

Sharing

Copy URL

Twitter E-mail

General

Target

a3f5325ad694c5971745b5c2f689b255
Size

92KB
MD5

a3f5325ad694c5971745b5c2f689b255
SHA1

655ef48f87e4fb24825b1d29fd48847e373be796
SHA256

bcfd39867a332f79b925936c51001770388e98eef94d79fcd28360142479f361
SHA512

785f7e72b63eb2ae548ec7e4edcbd2f2275ff2dd49c47d2960164d26591105b01d5b9b1e1934455fd675201f5f59b66865ab157e28eaa4a7b42855fb6ae2c0f3
SSDEEP

1536:v806LloS6hZsSsC8PG4ove9TzOdPRF4ykMCt7f//fLHTaluFm:v80YlWhZstCTvUFykft7fnTouFm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3f5325ad694c5971745b5c2f689b255

Files

a3f5325ad694c5971745b5c2f689b255
.exe windows:5 windows x86 arch:x86

619b49db1606c3d0d36ea5066849932a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
LZRead
GetConsoleHardwareState
GetTickCount
GetCalendarInfoW
VirtualQuery
VirtualAlloc
GetProcessAffinityMask
SetConsolePalette
FlushConsoleInputBuffer
GetUserDefaultLCID
GlobalCompact
GetVersion
lstrlenW
NlsGetCacheUpdateCount
CreateFiberEx

rpcrt4

NdrConformantVaryingStructMarshall
RpcBindingSetObject
RpcMgmtEpEltInqNextA
NdrUserMarshalUnmarshall
RpcNetworkIsProtseqValidA
RpcServerUseAllProtseqsEx
NdrConformantArrayMarshall
RpcEpUnregister
CreateStubFromTypeInfo
NdrPointerUnmarshall
NdrXmitOrRepAsBufferSize
NdrMesTypeFree2
NdrClientContextMarshall
I_RpcIfInqTransferSyntaxes
RpcBindingFromStringBindingA

msvcrt20

_ismbslead
fgetws
?pbase@streambuf@@IBEPADXZ
_rmdir
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
??4ostream_withassign@@QAEAAV0@ABV0@@Z
__CxxFrameHandler
??0ifstream@@QAE@XZ
_initterm
_assert
log
_mbclen
_dup2
_logb

ntdll

RtlEnableEarlyCriticalSectionEventCreation
RtlLookupElementGenericTable
RtlLengthSecurityDescriptor
RtlDosSearchPath_U
RtlDestroyAtomTable
ZwWriteFile
RtlpNotOwnerCriticalSection
RtlGetActiveActivationContext
RtlReleaseActivationContext
_alldvrm
NtUnlockVirtualMemory
CsrFreeCaptureBuffer

sqlunirl

_ExtractIcon_@12
_PropertySheet_@4
_GetPrivateProfileInt_@16
_CopyAcceleratorTable_@12
_CreateNamedPipe_@32
_LookupAccountName_@28
_SetDefaultCommConfig_@12
_DefMDIChildProc_@16
_RegEnumKeyEx_@32
_LoadBitmap@8
_WritePrivateProfileSection_@12
_QueryServiceLockStatus_@16
_AddFontResource_@4
_GrayString_@36
_EnumPropsEx_@12
_EnumDependentServices_@24
_GetVolumeInformation_@32

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

619b49db1606c3d0d36ea5066849932a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

rpcrt4

msvcrt20

ntdll

sqlunirl

Sections

.text Size: 43KB - Virtual size: 43KB

.data Size: 21KB - Virtual size: 28KB

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 512B - Virtual size: 212B

.text
Size: 43KB - Virtual size: 43KB

.data
Size: 21KB - Virtual size: 28KB

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 512B - Virtual size: 212B