ca42fcf61b29e53135003dc9a4fe7c14

Sharing

Copy URL

Twitter E-mail

General

Target

ca42fcf61b29e53135003dc9a4fe7c14
Size

85KB
MD5

ca42fcf61b29e53135003dc9a4fe7c14
SHA1

d475b55769b906c66e1470b0141b0dabc48b1f94
SHA256

f3b206f6de7527c395779a01aa06a3ffc30c43ab6a23541cd5cfe8993a1daa49
SHA512

971d762d167149fd1c0c8e47855b8fa431e6f4aad92dd20d142af2025d8b4b61f7c1b9dbad3504ecc5a7de98e8d34d7352e708b5b119f03aab0dcc2b9cca9674
SSDEEP

1536:kZUUtB08B7cBAr4ZfZnhKPouhQkgXSo+NFRNhp9qjKl/rmvbScR2Kqc9:fUtB08pcBAr4TnhKPHrecTp9eCrmGa2u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca42fcf61b29e53135003dc9a4fe7c14

Files

ca42fcf61b29e53135003dc9a4fe7c14
.exe windows:5 windows x86 arch:x86

f35ccb0ae3ba420da40a8b7840674ec8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp60

??9std@@YA_NABOABV?$complex@O@0@@Z
??0?$messages@G@std@@QAE@ABV_Locinfo@1@I@Z
??1__non_rtti_object@std@@UAE@XZ
?_Doraise@underflow_error@std@@MBEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@N@0@@Z
?polar@std@@YA?AV?$complex@O@1@ABO0@Z
?_Getyes@_Locinfo@std@@QBEPBDXZ
?fail@ios_base@std@@QBE_NXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?narrow@?$ctype@G@std@@QBEDGD@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?ldexp@?$_Ctr@N@std@@SANNH@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?abs@std@@YANABV?$complex@N@1@@Z

kernel32

SwitchToThread
GetConsoleAliasesLengthW
GetFirmwareEnvironmentVariableA
FindNextVolumeW
SetVDMCurrentDirectories
GetWriteWatch
Beep
CompareFileTime
IsWow64Process
SetCalendarInfoA
lstrcmpi
ReleaseActCtx
QueryPerformanceCounter
BindIoCompletionCallback
GetCurrentProcessId
LoadLibraryA
VirtualAlloc
GetModuleHandleW
GetCurrentThreadId
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
GetStringTypeW
SetFilePointerEx
VirtualAllocEx
SetConsoleMode
SetProcessAffinityMask
ConnectNamedPipe

ntdll

RtlMultiAppendUnicodeStringBuffer
RtlTraceDatabaseLock
NtQueryTimer
ZwCompareTokens
RtlValidRelativeSecurityDescriptor
RtlAddAccessAllowedAceEx
wcscat
RtlAddVectoredExceptionHandler
NtCreateDirectoryObject
RtlDestroyProcessParameters
NtSetInformationToken
ZwInitializeRegistry
NtLoadDriver
ZwSetInformationToken
RtlRunDecodeUnicodeString
RtlEnumerateGenericTableLikeADirectory
NtSetIoCompletion
DbgPrint

mssip32

DllRegisterServer
CryptSIPGetInfo
CryptSIPCreateIndirectData
CryptSIPRemoveSignedDataMsg
DllUnregisterServer
CryptSIPGetRegWorkingFlags
CryptSIPGetSignedDataMsg
CryptSIPPutSignedDataMsg
CryptSIPVerifyIndirectData

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f35ccb0ae3ba420da40a8b7840674ec8

Headers

DLL Characteristics

File Characteristics

Imports

msvcp60

kernel32

ntdll

mssip32

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 18KB - Virtual size: 69KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 328B

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 18KB - Virtual size: 69KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 328B