cb40a4be84530850f0b1192e11d82fcd

Sharing

Copy URL Twitter E-mail

General

Target

cb40a4be84530850f0b1192e11d82fcd
Size

205KB
MD5

cb40a4be84530850f0b1192e11d82fcd
SHA1

40972137c0eb6890aa92112b3a6a59837988d6bd
SHA256

9de713129f95d09263bffcf2a7f39ce9d016b5d36e0f9d11c8330432f04bdbe2
SHA512

c1c31d611bdb6038b8b2fc31154703ef1bd4779875bf229571fda01b9e22de46b16e72e0b87f29a8f4bea3bba03e8cc0473cc18ac77cf717997ce1b045801cfa
SSDEEP

3072:B9ezk84UgT/o6wzNyy7cBWp/ATnSA/5x55Xom2v7JtCzfo1NUULbo7dIVTn:B+tgboDl70ap+Tom4ko1uUxTn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb40a4be84530850f0b1192e11d82fcd

Files

cb40a4be84530850f0b1192e11d82fcd
.exe windows:4 windows x86 arch:x86

def8743135f229aa8764c07a496557a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_initterm
_adjust_fdiv
_except_handler3
malloc
free

ntdll

RtlLargeIntegerToChar
LdrGetDllHandle
NtAllocateVirtualMemory

kernel32

DisableThreadLibraryCalls
GetTickCount
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
QueryPerformanceCounter
UnhandledExceptionFilter
GetCurrentProcessId

rpcrt4

NdrStubGetBuffer
NdrSimpleTypeUnmarshall
NdrConformantArrayUnmarshall
NdrCStdStubBuffer2_Release
NdrConformantStringUnmarshall
NdrPointerMarshall
RpcRaiseException
NdrSimpleTypeMarshall
CStdStubBuffer_Connect
NdrUserMarshalMarshall
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
NdrSimpleStructUnmarshall
NdrUserMarshalBufferSize
NdrInterfacePointerBufferSize
NdrConformantArrayBufferSize
NdrPointerUnmarshall
NdrOleAllocate
IUnknown_QueryInterface_Proxy
NdrProxyFreeBuffer
NdrDllRegisterProxy
NdrPointerBufferSize
NdrDllGetClassObject
NdrOleFree
NdrProxyInitialize
NdrInterfacePointerFree
CStdStubBuffer_Invoke
NdrSimpleStructMarshall
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
NdrClearOutParameters
IUnknown_AddRef_Proxy
NdrDllCanUnloadNow
NdrProxyGetBuffer
NdrConformantStringBufferSize
NdrPointerFree
CStdStubBuffer_QueryInterface
NdrProxySendReceive
NdrStubCall2
NdrInterfacePointerMarshall
NdrAllocate
NdrStubInitialize
NdrUserMarshalFree
IUnknown_Release_Proxy
NdrUserMarshalUnmarshall
NdrConvert
CStdStubBuffer_DebugServerQueryInterface
NdrStubForwardingFunction
NdrConformantStringMarshall
NdrInterfacePointerUnmarshall
NdrSimpleStructBufferSize
NdrCStdStubBuffer_Release
NdrProxyErrorHandler
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_CountRefs
NdrConformantArrayMarshall

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 358KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

def8743135f229aa8764c07a496557a6

Headers

File Characteristics

Imports

msvcrt

ntdll

kernel32

rpcrt4

Sections

.text Size: 12KB - Virtual size: 12KB

.data Size: 32KB - Virtual size: 984KB

.rsrc Size: 358KB - Virtual size: 358KB

.reloc Size: 512B - Virtual size: 20B

.rdata Size: 59KB - Virtual size: 58KB

.text
Size: 12KB - Virtual size: 12KB

.data
Size: 32KB - Virtual size: 984KB

.rsrc
Size: 358KB - Virtual size: 358KB

.reloc
Size: 512B - Virtual size: 20B

.rdata
Size: 59KB - Virtual size: 58KB