b5a1019404a5aa6016185212678daba0

Sharing

Copy URL Twitter E-mail

General

Target

b5a1019404a5aa6016185212678daba0
Size

128KB
MD5

b5a1019404a5aa6016185212678daba0
SHA1

dee5f92a9b3ff0023a3811919ab25e2cc9cf8721
SHA256

7cc1bcb4652149489fe2e60364920ef64da067f27906d9d7bc1ac59b1a3d496f
SHA512

8b0ebacad2db3d7bf91d6b85270964a978971a233d747f1031c1bedc0ad19ac0f1cacb10d24ab322c713847d7b72e87dffb6b34295d1566fb32c42fad91e3306
SSDEEP

1536:0UMhXB2qCbYSkXP9tfH0nPc4CaD0sotjrGRMfko+nNQ6nRbljy:ZquYSkXFtf6PcnFfko+nNPRljy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5a1019404a5aa6016185212678daba0

Files

b5a1019404a5aa6016185212678daba0
.exe windows:4 windows x86 arch:x86

b47683ea097d67160ba7c615d65d34e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
FindResourceA
FindResourceExA
GetLastError
CloseHandle
WideCharToMultiByte
CreateFileA
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetTimeFormatA
GetDateFormatA
lstrcmpA
lstrlenA
GetPrivateProfileIntA
Thread32Next
Thread32First
CreateToolhelp32Snapshot
CreateMutexA
OpenMutexA
GetModuleFileNameA
OpenProcess
Process32Next
Process32First
TerminateProcess
LockResource
GetShortPathNameA
GetSystemTime
MultiByteToWideChar
RaiseException
InitializeCriticalSection
DeleteCriticalSection
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SizeofResource
InterlockedExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
WaitForSingleObject
GetStdHandle
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
IsBadWritePtr
VirtualFree
HeapCreate
SetUnhandledExceptionFilter
LocalAlloc
GetProcAddress
FreeLibrary
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
RtlUnwind
GetModuleHandleA
GetCurrentProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
GetOEMCP
GetCPInfo
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FlushFileBuffers

user32

SetTimer
PostThreadMessageA
GetMessageA
DispatchMessageA
TranslateMessage
KillTimer

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathA

shlwapi

PathAppendA
PathRemoveExtensionA
PathStripPathA

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b47683ea097d67160ba7c615d65d34e2

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

Sections

.text Size: 84KB - Virtual size: 81KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 84KB - Virtual size: 81KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 24KB - Virtual size: 23KB