c1c2890d75563684d808a259a0a318f9

General

Target

c1c2890d75563684d808a259a0a318f9
Size

139KB
MD5

c1c2890d75563684d808a259a0a318f9
SHA1

46bce2687863b4b1cdc71af55fb9137fa33b7951
SHA256

31d59e8ad3c47120b4cdf45c3f9ee3008089734daba2f9d525452ebb024c6b22
SHA512

339cae0fe3c5a9827d62c2d1622380b567d9a498e22e19eb721167494972e5cb32ef134093ac70ce0ecc08935e96cc67c898adc280d804c229d1480add4e7c10
SSDEEP

3072:PoXy8LuRMCT8tDuXLkuw7m2ZRh/rdBCICcEY2:Poi8TCwtDlA2fh//CLj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1c2890d75563684d808a259a0a318f9

Files

c1c2890d75563684d808a259a0a318f9
.exe windows:5 windows x86 arch:x86

e24e9612933cd6a6295527d459acb48b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetACP
CloseHandle
VirtualAlloc
ReadFile
SetFilePointer
GetFileSize
CreateFileA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
Sleep
GetCurrentProcessId
lstrlenA
GetTempPathA
LCMapStringW
RtlUnwind
RaiseException
GetCommandLineA
GetStartupInfoA
HeapAlloc
GetLastError
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetModuleHandleA
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapSize
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA

shlwapi

wnsprintfA

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e24e9612933cd6a6295527d459acb48b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

Sections

.text Size: 45KB - Virtual size: 45KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 35KB

.rsrc Size: 5KB - Virtual size: 5KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 35KB

.rsrc
Size: 5KB - Virtual size: 5KB