ba1869c7fdd37bc8195a03eef2927693

Sharing

Copy URL

Twitter E-mail

General

Target

ba1869c7fdd37bc8195a03eef2927693
Size

65KB
MD5

ba1869c7fdd37bc8195a03eef2927693
SHA1

dbdba82cf536aa7dd778eef1d2b2a3a7d1f6c12e
SHA256

c1d55de1aa1b784879ffd53fd7aa38424432a45453d53608a4440bbb23e981f5
SHA512

19c3689e5f81cf214eab05c75cdc767caa1f7eb586a0ee79113ccca2de140016ca21ff0bc03b1445e7e740d39c444ca490cba3147b898123d471a437166c1810
SSDEEP

768:XonhH/Rsf9RtTIX3UvOgdo8+weOzC6HH4IQa:XonxR6tkX8roX6C6HH4IQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba1869c7fdd37bc8195a03eef2927693

Files

ba1869c7fdd37bc8195a03eef2927693
.exe windows:6 windows x86 arch:x86

a9369b9de97f15501ef8311c524520d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

upnpcont.pdb

Imports

user32

PostThreadMessageW
CharNextW
DispatchMessageW
GetMessageW
DestroyWindow

msvcrt

_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_onexit
_exit
_cexit
__wgetmainargs
malloc
_callnewh
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_purecall
_wcsicmp
memset
_beginthreadex
free
?terminate@@YAXXZ
_controlfp
_XcptFilter

atl

ord20
ord17
ord23
ord57
ord18
ord21
ord16
ord32

ntdll

EtwTraceMessage

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW

kernel32

SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
DelayLoadFailureHook
HeapSetInformation
GetCommandLineW
GetModuleFileNameW
GetModuleHandleA
CreateEventW
UnregisterWait
WaitForSingleObject
CloseHandle
SetEvent
LeaveCriticalSection
EnterCriticalSection
lstrlenW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetFullPathNameW
ExitProcess
InterlockedDecrement
InterlockedIncrement
CreateThread
RegisterWaitForSingleObject
OpenProcess
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

agybwoj
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a9369b9de97f15501ef8311c524520d5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcrt

atl

ntdll

api-ms-win-core-localregistry-l1-1-0

kernel32

Sections

.text Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 28KB - Virtual size: 29KB

agybwoj Size: - Virtual size: 4KB

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 28KB - Virtual size: 29KB

agybwoj
Size: - Virtual size: 4KB