baba79e7fcb662e65592e34e4edc36e0

General

Target

baba79e7fcb662e65592e34e4edc36e0
Size

111KB
MD5

baba79e7fcb662e65592e34e4edc36e0
SHA1

0b8aa461f01640b7d109c0fe26de479e032cee70
SHA256

74442799953c18452da85bcab45541d373681132cbb22b34777f1d2a47297591
SHA512

e235bc740cd6caca8a17540f99994a47c81ac854cc0acef76ff7f229ebef0b6773f73c8df472a8d42184e7e55000fee7fc975ad633eb4a8411d888218be74b4c
SSDEEP

3072:4+f+23qAfAM2V7K9R6wJjU+H2GH0RF4t+va6:4+f+eq0SxwtU5GHsGt+9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
baba79e7fcb662e65592e34e4edc36e0

Files

baba79e7fcb662e65592e34e4edc36e0
.exe windows:4 windows x86 arch:x86

6cdafea934ff4ec7fcf459c9e1cd3842

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetCurrentThreadId
OutputDebugStringA
GetFileTime
lstrcatA
WritePrivateProfileStringA
DeleteFileA
FreeResource
lstrlenA
CreateMutexA
SetFileTime
LocalFileTimeToFileTime
GetTempPathA
GetFileAttributesA
lstrcmpA
SetLastError
LocalReAlloc
LocalFree
LocalAlloc
GetLastError
ReleaseMutex
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
Sleep
GetSystemDirectoryA
CopyFileA
GetVersion
LoadLibraryA
GetProcAddress
FreeLibrary
CreateRemoteThread
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
CloseHandle
WriteFile
GetTickCount

user32

wsprintfA
GetInputState
PostThreadMessageA
GetMessageA
MessageBoxA

advapi32

OpenServiceA
CloseServiceHandle
StartServiceA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
CreateServiceA
EnumServicesStatusA
QueryServiceConfigA
UnlockServiceDatabase
ChangeServiceConfigA
LockServiceDatabase
OpenSCManagerA

msvcrt

_strlwr
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
rand
realloc
malloc
strncmp
strtoul
isdigit
rename
sprintf
??2@YAPAXI@Z
strchr
strstr
fclose
fread
fseek
fopen
exit

Sections

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6cdafea934ff4ec7fcf459c9e1cd3842

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

Sections

.data Size: 12KB - Virtual size: 12KB

.CRT Size: 512B - Virtual size: 4B

.data
Size: 12KB - Virtual size: 12KB

.CRT
Size: 512B - Virtual size: 4B