bf142cb40ff6996cfec9dd67139bedfa

Sharing

Copy URL Twitter E-mail

General

Target

bf142cb40ff6996cfec9dd67139bedfa
Size

92KB
MD5

bf142cb40ff6996cfec9dd67139bedfa
SHA1

09426b72cc3b03ee925af8aae75c1cb706eb4416
SHA256

35bd9bd7872d6cd189a7bed6967b23ff84ab23822d49195bfedc252e134c78d1
SHA512

4299951359c3614cf8ca0b719b11272e0d5cf5954d1e76f92c669f9eb8d2908ba23083c26795831f3f3831e8e8b2b590fee060b0ae78b2bc5fe3227b10c3d364
SSDEEP

1536:vTUdFt1n6in6a81CxwpPWhmUMOEboKCialJoIo:vaFyk0OE8SalJoIo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf142cb40ff6996cfec9dd67139bedfa

Files

bf142cb40ff6996cfec9dd67139bedfa
.exe windows:4 windows x86 arch:x86

51f37b05bbde5be3f377c657c5ba1b2e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecA
PathAppendA
wnsprintfA

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
lstrcpyA
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
InitializeCriticalSection
InterlockedExchange
MultiByteToWideChar
SetStdHandle
LCMapStringW
LCMapStringA
GetSystemInfo
VirtualProtect
SetFilePointer
GetCPInfo
GetOEMCP
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetLastError
lstrlenA
FlushFileBuffers
CloseHandle
DeleteCriticalSection
HeapFree
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
ExitProcess
RtlUnwind
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
VirtualQuery
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte

user32

DialogBoxParamA
ShowWindow
EndDialog
SendMessageA
GetDesktopWindow
GetWindowRect
SetWindowPos
SetWindowTextA
GetDlgItem
LoadIconA

advapi32

RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51f37b05bbde5be3f377c657c5ba1b2e

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 40KB - Virtual size: 37KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 7KB

.shared Size: 4KB - Virtual size: 16B

.rsrc Size: 28KB - Virtual size: 27KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 7KB

.shared
Size: 4KB - Virtual size: 16B

.rsrc
Size: 28KB - Virtual size: 27KB