be136132eb00258e746f37bc74ad9c9b

Sharing

Copy URL Twitter E-mail

General

Target

be136132eb00258e746f37bc74ad9c9b
Size

829KB
MD5

be136132eb00258e746f37bc74ad9c9b
SHA1

26af8c9666abe533a84abe8ca867bf84662ba15a
SHA256

59283b238cbc9b83bf3e6977ada31797f0a273515f496ecb6262a4d821c8ab59
SHA512

380ad1b91d53c9d4c4b0ff10515ce6894654960db86689298146be1025f48c4024ccd0ab9a6452c1757ce402383324b7aac41172c5a09cd7b233054e60b2658b
SSDEEP

24576:DVNzOfdwNVNzOfdwNVNzOfdwNVNzOfdwNVNzOfdwNVNzOfdw:DHnNHnNHnNHnNHnNHn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be136132eb00258e746f37bc74ad9c9b

Files

be136132eb00258e746f37bc74ad9c9b
.exe windows:4 windows x86 arch:x86

26197317de0c30f977e0873076f7d845

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetModuleFileNameA
MoveFileExA
SetThreadPriority
CreateFileW
GetCommandLineA
CreateProcessA
GetCurrentThreadId
CreateThread
WaitForSingleObject
DeviceIoControl
GetTempPathA
SetFileAttributesA
DeleteFileA
WriteFile
GetShortPathNameA
Sleep
ReleaseSemaphore
GetVersionExA
GetStringTypeW
GetStringTypeA
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32First
GetWindowsDirectoryA
Module32Next
GetCurrentProcessId
OpenProcess
TerminateProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetLastError
LCMapStringW
CreateFileA
CreateSemaphoreA
lstrlenA
lstrcpyA
RtlUnwind
HeapAlloc
HeapFree
GetVersion
ExitProcess
HeapReAlloc
GetCurrentProcess
HeapSize
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
FlushFileBuffers
LCMapStringA
CloseHandle

user32

FindWindowA
MessageBoxA
GetInputState
PostThreadMessageA
GetMessageA
CharUpperBuffA
GetSystemMetrics
SetWindowTextA

advapi32

RegEnumKeyExA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
StartServiceA
CreateServiceA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CloseServiceHandle

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList

hid

HidD_SetFeature
HidD_GetFeature
HidP_GetScaledUsageValue
HidP_GetUsageValue
HidP_GetUsages
HidP_SetUsageValue
HidP_SetUsages
HidP_GetCaps
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetPreparsedData
HidP_GetSpecificValueCaps
HidD_GetHidGuid

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pack
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

26197317de0c30f977e0873076f7d845

Headers

File Characteristics

Imports

kernel32

user32

advapi32

setupapi

hid

Sections

.text Size: 73KB - Virtual size: 72KB

.pack Size: 60KB - Virtual size: 60KB

.rsrc Size: 4KB - Virtual size: 8KB

.text
Size: 73KB - Virtual size: 72KB

.pack
Size: 60KB - Virtual size: 60KB

.rsrc
Size: 4KB - Virtual size: 8KB