b5e834aa0c9aa7f470f15bd3c5ccfe84

General

Target

b5e834aa0c9aa7f470f15bd3c5ccfe84
Size

138KB
MD5

b5e834aa0c9aa7f470f15bd3c5ccfe84
SHA1

fe127240ded9650923d6b5c81c3e804e825517cc
SHA256

77fd9354d3dd8e9c5a96481d7e6debc684cef876407b8cde42811c2fdb4fd4c2
SHA512

6bea9b0b3c9e91b4b97e00965aef7338ffaeec87302502e30abd7129f4b391baf49471b76dca3879789d5e1243220a2961fe17921f7ceb4e25b65b92d6c4b886
SSDEEP

1536:QE2M43TyjvrXu29bw/X0I0ytLjcE2PrHVhC2MNdJs4SNV9LvBzIQYZFzIMjB7/zr:QtEeL0oLm7VsnNda4Iz/YZ5jB7/zr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5e834aa0c9aa7f470f15bd3c5ccfe84

Files

b5e834aa0c9aa7f470f15bd3c5ccfe84
.exe windows:4 windows x86 arch:x86

6b5f321d5510881437fd706e880b096c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadProcessMemory
lstrcpyA
CreateProcessA
lstrcatA
GetWindowsDirectoryA
DuplicateHandle
GetCurrentProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersionExA
GetComputerNameA
lstrcmpA
CopyFileA
DeleteFileA
SetFileAttributesA
VirtualProtectEx
lstrlenA
GetSystemDirectoryA
GetFileSize
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetProcessHeap
CreateRemoteThread
SetLastError
GetCurrentProcessId
VirtualFree
WriteProcessMemory
Sleep
GetModuleHandleA
GetProcAddress
WaitForSingleObject
WriteFile
CloseHandle
VirtualAlloc
GetPriorityClass
ResumeThread

user32

FindWindowA
GetWindowThreadProcessId
wsprintfA

advapi32

RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
GetUserNameA
RegSetValueExA

shlwapi

SHDeleteKeyA

msvcrt

_strrev
strrchr
strncpy
strchr
atoi
free
malloc
_strnicmp
_stricmp

Sections

.data
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b5f321d5510881437fd706e880b096c

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

Sections

.data Size: 44KB - Virtual size: 44KB

.pdata Size: 24KB - Virtual size: 24KB

.ex_cod Size: 8KB - Virtual size: 8KB

.ex_rsc Size: 8KB - Virtual size: 8KB

.data
Size: 44KB - Virtual size: 44KB

.pdata
Size: 24KB - Virtual size: 24KB

.ex_cod
Size: 8KB - Virtual size: 8KB

.ex_rsc
Size: 8KB - Virtual size: 8KB