c0861094cbffbef5b84c17be5e5d1605

General

Target

c0861094cbffbef5b84c17be5e5d1605
Size

283KB
MD5

c0861094cbffbef5b84c17be5e5d1605
SHA1

501420eaedca08f2343c443fd144725e87ec97d3
SHA256

abf016f919d093b02f72ec45c1bed9e3cdf1e6b4e150c96f43b22e3478b99a81
SHA512

1e7fff90c580b855d7c0b15ea2a3d9d10b2fbb6a5eb314e4975134569d45ef05367a4bcf1583890aee9c066c06b0546ffc8895a886f2ae202f313d4525558076
SSDEEP

6144:lASNwi/3yUIGnx2Y9wfYpAhn5JuyqiN4hMrzxalTtO:NNFvRIGom+siNGmFv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0861094cbffbef5b84c17be5e5d1605

Files

c0861094cbffbef5b84c17be5e5d1605
.exe windows:4 windows x86 arch:x86

4733a4721792f3491a6c8677d2928537

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

DestroyWindow
IsWindow
CreateWindowExW
GetDlgItem
EnumChildWindows
SendMessageA
GetWindowThreadProcessId

shell32

SHGetFolderPathW

kernel32

AddAtomA
HeapDestroy
GetEnvironmentStringsW
WriteFile
GetFileType
FreeEnvironmentStringsA
GetCurrentProcessId
HeapSize
VirtualFree
GetStartupInfoA
GetModuleFileNameA
InterlockedExchange
HeapCreate
IsBadWritePtr
GetSystemTimeAsFileTime
GetCurrentProcess
TlsFree
TerminateProcess
UnhandledExceptionFilter
EnumResourceLanguagesA
GetLocaleInfoA
TlsSetValue
VirtualAlloc
FormatMessageW
SetHandleCount
GetEnvironmentStrings
GetOEMCP
GetStdHandle
SetEndOfFile
GetCPInfo
QueryPerformanceCounter
VirtualQuery
SetLastError
GetVersionExA
TlsAlloc
GetACP
GetSystemInfo
FreeEnvironmentStringsW
TlsGetValue
SetUnhandledExceptionFilter

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

setupapi

CM_Get_Parent
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

iphlpapi

GetIpAddrTable

Sections

.text
Size: 144KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4733a4721792f3491a6c8677d2928537

Headers

File Characteristics

Imports

newdev

user32

shell32

kernel32

mprapi

setupapi

iphlpapi

Sections

.text Size: 144KB - Virtual size: 279KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 136KB - Virtual size: 135KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 144KB - Virtual size: 279KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 136KB - Virtual size: 135KB

.rsrc
Size: 512B - Virtual size: 4KB