ca8dde3b5b5b6d8997e41c17122f0fee

Sharing

Copy URL Twitter E-mail

General

Target

ca8dde3b5b5b6d8997e41c17122f0fee
Size

112KB
MD5

ca8dde3b5b5b6d8997e41c17122f0fee
SHA1

f72300ae419738ffd017bc7c65674e5c70fc627b
SHA256

77e332da8ca9467b7540d50d518a772cc9db96c8db5273aaf52db28f317ee737
SHA512

0767dfe012bab4eea2d444225bbac793eef298743a0eaead4ddd5e7dc1e3363cc64145645e79c70dff280d2bc33571264746331a41cdefc02aff000be7de7214
SSDEEP

3072:DFezikv6+MHeyrkpKXwYr1XczER+3stAhPKLm8G:DsVv6+WgXAXaS+ct6YM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca8dde3b5b5b6d8997e41c17122f0fee

Files

ca8dde3b5b5b6d8997e41c17122f0fee
.exe windows:4 windows x86 arch:x86

b7cc8c0677b7e01a11c72cd6ea0ca397

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
ExitProcess
WinExec
CopyFileA
CreateThread
GetCurrentThreadId
CreateDirectoryA
HeapAlloc
SetUnhandledExceptionFilter
GetWindowsDirectoryA
ReleaseMutex
CreateMutexA
GetCommandLineA
GetModuleHandleA
GetStartupInfoA
GetProcAddress
HeapFree
GetLastError
lstrcpyA
SetLastError
lstrcmpiA
GetTempPathA
GetTickCount
FindResourceA
LoadResource
GetSystemDirectoryA
lstrcatA
FindFirstFileA
LocalFileTimeToFileTime
SetFileTime
SizeofResource
WriteFile
FreeResource
MoveFileA
DeleteFileA
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
OutputDebugStringA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
lstrlenA
Sleep
GetFileAttributesA

user32

LoadIconA
LoadCursorA
RegisterClassExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
PostQuitMessage
wsprintfA
MessageBoxA
GetDesktopWindow
GetTopWindow
GetWindowRect
WindowFromPoint
CreateWindowExA
GetCursorPos
IsWindow
SetForegroundWindow
GetWindow
GetClassNameA
GetWindowTextA
GetInputState
SendMessageA
SetCursorPos
mouse_event
PostThreadMessageA

advapi32

RegQueryValueExA
RegCloseKey
RegSetValueExA
GetUserNameA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
CloseServiceHandle
CreateServiceA
OpenSCManagerA
SetFileSecurityA
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetFileSecurityA
LookupAccountNameA
StartServiceA
OpenServiceA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA

msvcrt

__CxxFrameHandler
_except_handler3
rand
strchr
strstr
realloc
malloc
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__set_app_type
_controlfp
__p__fmode
??2@YAPAXI@Z
memset
strlen
??3@YAXPAX@Z
memcpy

netapi32

NetApiBufferFree
NetUserGetLocalGroups

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7cc8c0677b7e01a11c72cd6ea0ca397

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

netapi32

Sections

.text Size: 11KB - Virtual size: 11KB

.rsrc Size: 100KB - Virtual size: 99KB

.text
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 100KB - Virtual size: 99KB