fbd0d579f705f2140165b9c862631c0b93fb5b5a77087db2c4704a2abf36eb03

Sharing

Copy URL

Twitter E-mail

General

Target

fbd0d579f705f2140165b9c862631c0b93fb5b5a77087db2c4704a2abf36eb03
Size

1.8MB
MD5

7ff1c9a6372c91dc4c4bdd80ab09aa13
SHA1

73179f2744c5ec6885dcaaf94884762801a46d58
SHA256

fbd0d579f705f2140165b9c862631c0b93fb5b5a77087db2c4704a2abf36eb03
SHA512

d7c698c48b92972aea38ad23d896a399e1854afcac254549193db267d66424dff0ccf7c6c54a8a12b589e7b275a342448990ba268554dba9381f37074da1c262
SSDEEP

49152:BcV+ajoJaeh/XDgUQhia5Gv2h4SFFJLKhepWY:BH8k5TgV/5GvXStLKh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbd0d579f705f2140165b9c862631c0b93fb5b5a77087db2c4704a2abf36eb03

Files

fbd0d579f705f2140165b9c862631c0b93fb5b5a77087db2c4704a2abf36eb03
.exe windows:5 windows x86 arch:x86

d1367f3497636e00c6d376c036f41595

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\xb_bs\pubgbox\out\Release\pubgbox.pdb

Imports

kernel32

RaiseException
GetLastError
HeapSize
DecodePointer
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetTempPathW
GetTempFileNameW
GetModuleFileNameW
GetCurrentProcess
CreateProcessW
GetProcAddress
GetModuleHandleW
OpenProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenFileMappingW
MapViewOfFile
SetErrorMode
GetFileAttributesW
CreateMutexW
DeleteFileW
CopyFileW
FlushFileBuffers
WriteConsoleW
InitializeCriticalSectionAndSpinCount
GetProcessHeap
GetTickCount
HeapFree
HeapAlloc
HeapReAlloc
CloseHandle
SetStdHandle
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
RtlUnwind
LoadLibraryExW
LCMapStringW
CreateFileW
ReadFile
WriteFile
Sleep
GetFileSize
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetFileType
GetStdHandle
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
GetSystemTimeAsFileTime
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
ExitProcess
GetModuleHandleExW

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CertOpenSystemStoreA
CertCloseStore

wininet

InternetOpenA
HttpSendRequestA
InternetConnectW
InternetSetOptionW
InternetCloseHandle
InternetConnectA
HttpOpenRequestW
HttpSendRequestExW
InternetReadFile
InternetOpenW
InternetWriteFile
HttpEndRequestW
HttpAddRequestHeadersW
HttpOpenRequestA

psapi

GetModuleFileNameExW
EnumProcessModules

Sections

.text
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1367f3497636e00c6d376c036f41595

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

crypt32

wininet

psapi

Sections

.text Size: 115KB - Virtual size: 115KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 1.6MB - Virtual size: 1.6MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 115KB - Virtual size: 115KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB