cb0749c370d16dac80a9eb0c7bf63bda

Sharing

Copy URL Twitter E-mail

General

Target

cb0749c370d16dac80a9eb0c7bf63bda
Size

533KB
MD5

cb0749c370d16dac80a9eb0c7bf63bda
SHA1

cce07d2f3c1b92dd453658c737da9698475d6fdb
SHA256

a5773434166244d3552cc26bd43490222cadf10f38e640cb41cefa11f0fbdb36
SHA512

80849c5642a30a0d63671d3101fa854122ff1896924e70b48ec7435e523845c57a65480b993a0586d59d6f41cd891aa248c7ba745b0789a32fda392827ad976e
SSDEEP

12288:j7oSDDbcsnCPJUjeF/6GJTUqk+1VnHrJX+e0kSPj3tGHII/wlmtoANf2moUlODcR:XoSDDbcsCPJUjeF/6GJTUqk+1VHrJX+U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb0749c370d16dac80a9eb0c7bf63bda

Files

cb0749c370d16dac80a9eb0c7bf63bda
.exe windows:6 windows x86 arch:x86

5ea828424f9cac14a94296b78492db89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFolderPathW

kernel32

GetCurrentProcess
LoadLibraryA
GetProcAddress
GetVersionExA
GetSystemInfo
GetModuleHandleA
Process32Next
lstrcatA
HeapAlloc
HeapFree
lstrlenA
CreateToolhelp32Snapshot
Process32First
LeaveCriticalSection
EnterCriticalSection
GetComputerNameA
Sleep
SetEvent
VirtualAlloc
MultiByteToWideChar
lstrlenW
CreateDirectoryW
CopyFileW
DeleteFileW
SetLastError
GetLastError
CreateEventA
VirtualFreeEx
GetTickCount
VirtualAllocEx
IsBadReadPtr
ExitProcess
CreateRemoteThread
DuplicateHandle
CreateProcessW
GetProcessVersion
MapViewOfFile
CreateFileMappingA
InitializeCriticalSection
VirtualQuery
GetModuleFileNameW
lstrcpyW
lstrcatW
GetCurrentProcessId
CreateMutexA
OpenProcess
TerminateProcess
GetCommandLineA
ReadProcessMemory
VirtualQueryEx
lstrcmpiA
WideCharToMultiByte
lstrcmpA
VirtualFree
ResumeThread
SuspendThread
CreateFileW
WriteFile
ReleaseSemaphore
GetCurrentThread
CloseHandle
TerminateThread
WaitForSingleObject
CreateThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreA
lstrcpyA
WriteProcessMemory
GetProcessHeap

user32

RegisterClassExA
CreateWindowExA
GetSystemMetrics
wsprintfA
wsprintfW
DispatchMessageA
GetMessageA
DefWindowProcA
TranslateMessage

advapi32

OpenProcessToken
AdjustTokenPrivileges
GetUserNameA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExW
RegSetValueExA
RegNotifyChangeKeyValue
RegDeleteKeyA
LookupPrivilegeValueA

ole32

CoCreateGuid

urlmon

ObtainUserAgentString

wininet

HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetGetCookieA
InternetReadFile
InternetOpenUrlA
HttpSendRequestA
InternetCloseHandle

shlwapi

StrCmpNIA
StrStrA

rpcrt4

UuidToStringA

Sections

.text
Size: 465KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ea828424f9cac14a94296b78492db89

Headers

DLL Characteristics

File Characteristics

Imports

shell32

kernel32

user32

advapi32

ole32

urlmon

wininet

shlwapi

rpcrt4

Sections

.text Size: 465KB - Virtual size: 465KB

.data Size: 1024B - Virtual size: 18KB

.idata Size: 3KB - Virtual size: 3KB

.reloc Size: 62KB - Virtual size: 62KB

.text
Size: 465KB - Virtual size: 465KB

.data
Size: 1024B - Virtual size: 18KB

.idata
Size: 3KB - Virtual size: 3KB

.reloc
Size: 62KB - Virtual size: 62KB