c0756728fa310e30c6de1041dbf7c86c

Sharing

Copy URL Twitter E-mail

General

Target

c0756728fa310e30c6de1041dbf7c86c
Size

244KB
MD5

c0756728fa310e30c6de1041dbf7c86c
SHA1

bc94096da10e9857f778c620167e187403243e24
SHA256

75ec4da3b163f4a43303caed4989d452d8e5370031d9d48d0ca56bde551dc443
SHA512

9dc8308dfa7d41910dd3576f3aeca557f369803ae43c9b799416acf59606e817c9aef1d5443c7d8d3cdb641a43f8e6419fa9dc83a16c67537c28d6b69f38f114
SSDEEP

6144:tM23S/s6DS1P5FNEWn3lEQTMgAhjcIDRX0CFpzlYD:tM26s62fFDn1EFgAhjFRX5rOD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0756728fa310e30c6de1041dbf7c86c

Files

c0756728fa310e30c6de1041dbf7c86c
.exe windows:5 windows x86 arch:x86

2ce118b8aa9a3d81d6312d70f6f5a717

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryW
GetFullPathNameW
DeleteFileW
ExitProcess
GetStringTypeA
Sleep
GetVersion
IsBadReadPtr
GetCommandLineA
GetCurrentProcessId
GetTickCount
LoadLibraryExA
IsBadWritePtr
GetDriveTypeA
ResetEvent
FindResourceW
HeapReAlloc
GetExitCodeProcess
OpenEventA
SetFilePointer
GetThreadLocale
OpenEventW
GlobalLock
GetDriveTypeW
QueryPerformanceCounter
VirtualAlloc
HeapDestroy
GetSystemTimeAsFileTime
GetFileAttributesA
FormatMessageA
GetLocalTime
FindResourceA
GetConsoleMode
GetModuleHandleW
FreeEnvironmentStringsA
GetLastError
GetEnvironmentStrings
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount

shlwapi

StrStrIW
PathIsURLW
StrCpyW
PathFindExtensionW
PathStripToRootA
PathFindFileNameW
PathAppendW
PathIsRootW
PathGetDriveNumberW
wnsprintfW
StrCatBuffW
StrCatW
StrCpyNW
PathCombineW
SHDeleteKeyW
StrStrW
SHGetValueW
StrToIntW
SHRegGetBoolUSValueW
StrRetToBufW
PathIsUNCW
PathIsDirectoryW
StrToIntExW
AssocQueryStringW
SHSetValueW
PathFindExtensionA
PathRemoveBackslashW
SHDeleteValueW
StrCmpNW
PathCreateFromUrlW
StrCmpNIW
wnsprintfA

rpcrt4

RpcEpResolveBinding
RpcBindingSetAuthInfoW
CStdStubBuffer_DebugServerRelease
RpcBindingSetAuthInfoExW
CStdStubBuffer_QueryInterface
RpcBindingFree
RpcServerRegisterAuthInfoW
CStdStubBuffer_Invoke
RpcStringFreeW
NdrDllGetClassObject
NdrDllRegisterProxy
IUnknown_Release_Proxy
RpcRaiseException

comdlg32

ChooseColorA
GetSaveFileNameW
FindTextW
ChooseFontA
CommDlgExtendedError
PageSetupDlgW
GetFileTitleW
PrintDlgW
GetSaveFileNameA
PageSetupDlgA
ChooseColorW
PrintDlgExW
FindTextA
GetFileTitleA

msvcrt

wcscmp
_itow
__set_app_type
_itoa
towupper
printf
iswdigit
wcstoul
_adjust_fdiv

comctl32

CreateStatusWindowW

advapi32

RegSetValueA
SetThreadToken
ChangeServiceConfigW
CryptAcquireContextA
OpenSCManagerW
RegOpenKeyExA
EqualSid
GetSecurityDescriptorControl
GetTokenInformation
AllocateAndInitializeSid
RegConnectRegistryW
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueA
LookupPrivilegeValueA
GetSecurityDescriptorOwner
StartServiceW
OpenServiceW
OpenServiceA
GetSidLengthRequired
RegCreateKeyW
OpenSCManagerA
LookupAccountNameW

Sections

.tls
Size: 512B - Virtual size: 485B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 483B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 489B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ce118b8aa9a3d81d6312d70f6f5a717

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

rpcrt4

comdlg32

msvcrt

comctl32

advapi32

Sections

.tls Size: 512B - Virtual size: 485B

DATA Size: 512B - Virtual size: 484B

.code Size: 221KB - Virtual size: 220KB

DATA Size: 512B - Virtual size: 483B

.idata Size: 512B - Virtual size: 245KB

.tls Size: 512B - Virtual size: 489B

.rsrc Size: 19KB - Virtual size: 19KB

.tls
Size: 512B - Virtual size: 485B

DATA
Size: 512B - Virtual size: 484B

.code
Size: 221KB - Virtual size: 220KB

DATA
Size: 512B - Virtual size: 483B

.idata
Size: 512B - Virtual size: 245KB

.tls
Size: 512B - Virtual size: 489B

.rsrc
Size: 19KB - Virtual size: 19KB