b90be294111e2ecab7888fc9c4b31f61

General

Target

b90be294111e2ecab7888fc9c4b31f61
Size

240KB
MD5

b90be294111e2ecab7888fc9c4b31f61
SHA1

58a0c225abff306c6672d22e298c7c101f5e6b23
SHA256

5e8d524d4c4ff02533ba4a291be5a3045b60a3b41bf5572ea2047a9c3cf7e25c
SHA512

a1db5455cd010ba2d0ba5bbde9e77cb9dea7166bfc6657fe694d718e161872596fdd816d3a989ccf5c742188792b685f873dce4642456ade4ca8f68a8300de5e
SSDEEP

1536:megfb4nJr88N7H9+bGz2OSH45L6mLJcLxHf0y/pDpYU7lFqIzDEc:Gb4/35de0y/pDp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b90be294111e2ecab7888fc9c4b31f61

Files

b90be294111e2ecab7888fc9c4b31f61
.exe windows:4 windows x86 arch:x86

92ea9e9d6b29cebcabfcec6b13c48380

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Works\KernelBots_Up1\Server\Release\Server.pdb

Imports

kernel32

WriteFile
LockResource
GlobalAlloc
LoadResource
SizeofResource
FindResourceA
CopyFileW
DeleteFileW
GlobalFree
GetModuleFileNameW
VirtualAlloc
HeapReAlloc
GetModuleHandleW
GetCurrentProcessId
OpenProcess
ExitProcess
GetCurrentProcess
LoadLibraryW
GetProcAddress
GetTickCount
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
Sleep
lstrcpyW
lstrcatW
CreateFileW
CloseHandle
GetFileTime
GetSystemDirectoryW
SetFileTime
RtlUnwind
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleFileNameA
InterlockedExchange
VirtualQuery
GetModuleHandleA
TerminateProcess
LoadLibraryA

user32

CreateWindowExW
ShowWindow
UpdateWindow
DefWindowProcW
RegisterClassExW

advapi32

RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceW
EnumDependentServicesW
OpenServiceW
QueryServiceStatus
ControlService
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
RegOpenKeyExW
RegSetValueExW
RegCloseKey
StartServiceCtrlDispatcherW

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92ea9e9d6b29cebcabfcec6b13c48380

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 44KB - Virtual size: 40KB

.rsrc Size: 176KB - Virtual size: 173KB

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 44KB - Virtual size: 40KB

.rsrc
Size: 176KB - Virtual size: 173KB