c09a7d7d8d322e9b984882a3918a397e

Sharing

Copy URL Twitter E-mail

General

Target

c09a7d7d8d322e9b984882a3918a397e
Size

440KB
MD5

c09a7d7d8d322e9b984882a3918a397e
SHA1

54e1319830e0270eb17f4381543874382d2aa54c
SHA256

02f03fda64f73b96c4121fc4beab2d7d507b4ebbb47b1b47a1700f2bcd628b43
SHA512

b364e735541304045409f2dbe2a0b6480c1f96e83d30ebe026db1e0af143c2b55e2a55ea4f0171ccf2e6c6a6ed37f9efd3cb025c2ddc83cd1b69fbc92599c8dc
SSDEEP

6144:yGbctM1XHjRXOIOcSqBrB8YB38DNmXGRKPX1M:X4QXl5nNPvO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c09a7d7d8d322e9b984882a3918a397e

Files

c09a7d7d8d322e9b984882a3918a397e
.exe windows:4 windows x86 arch:x86

3dc83e3b640be078e09df288361fd133

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\working\4-sourcecontrol\trunk\appstart\release\Fetion.pdb

Imports

kernel32

MultiByteToWideChar
WriteFile
SetFilePointer
FindFirstFileW
CloseHandle
GetModuleFileNameW
WideCharToMultiByte
Sleep
CreateProcessW
CreateFileA
FlushFileBuffers
FindClose
GetModuleFileNameA
HeapAlloc
GetLastError
HeapReAlloc
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetProcAddress
GetModuleHandleA
ExitProcess
GetStdHandle
HeapSize
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

MessageBoxW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3dc83e3b640be078e09df288361fd133

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 364KB - Virtual size: 428KB

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 364KB - Virtual size: 428KB