c5e8416d4f374876b588b9dbd2add05c

Sharing

Copy URL Twitter E-mail

General

Target

c5e8416d4f374876b588b9dbd2add05c
Size

200KB
MD5

c5e8416d4f374876b588b9dbd2add05c
SHA1

7086bb13cf295d47dbb43bb0bc01edd78be65e95
SHA256

f48dde6728acc1881dc83b7dfb4ce6b6c85ac37bb6046156a4902fddb7c316fc
SHA512

18c573ecd5e76c73d317f02e87826b6a928fd190de3d2bf5e5044af1b66c6d6aebad534325cd7aebe02e19784c913e52de729897bf998abc5cb71e19047143e2
SSDEEP

3072:mHWfNl3UtDMYiuaTyI1lTL0FpKyKpbI2ii5l2ZxK:lffUtOph1NLO0yQcxZs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c5e8416d4f374876b588b9dbd2add05c

Files

c5e8416d4f374876b588b9dbd2add05c
.exe windows:4 windows x86 arch:x86

caa4e49714f609f50906115973131c2d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Works\ByShell_Up22\WinStart\Release\WinStart.pdb

Imports

kernel32

GetSystemDirectoryA
ResumeThread
CreateProcessW
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatW
lstrcpyW
GetEnvironmentVariableW
GetShortPathNameW
GetModuleFileNameW
CreateFileA
FindResourceA
SetFilePointer
OutputDebugStringA
GetTimeFormatA
GetLocalTime
SetCurrentDirectoryA
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
Sleep
GetTickCount
CopyFileA
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
DeleteFileA
GetModuleFileNameA
GetACP
GetLocaleInfoA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetSystemInfo
VirtualProtect
FindResourceW
SizeofResource
LoadResource
GlobalAlloc
LockResource
CreateFileW
WriteFile
CloseHandle
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
LoadLibraryA
Process32Next
Process32First
CreateToolhelp32Snapshot
ExitProcess
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapReAlloc
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualQuery
ReadFile
TerminateProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
SetStdHandle
FlushFileBuffers
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetOEMCP
GetCPInfo
SetEndOfFile
InterlockedExchange

user32

RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
DefWindowProcW

advapi32

ControlService
OpenSCManagerW
OpenServiceA
StartServiceW
QueryServiceStatus
EnumDependentServicesW
OpenServiceW
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SC v1.2
Size: 50B - Virtual size: 50B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

caa4e49714f609f50906115973131c2d

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 144KB - Virtual size: 140KB

SC v1.2 Size: 50B - Virtual size: 50B

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 144KB - Virtual size: 140KB

SC v1.2
Size: 50B - Virtual size: 50B