07ecddcd9c3765037116d1a659bd2867a3456a07bd31bc8615b147fb85b83a74

Sharing

Copy URL Twitter E-mail

General

Target

07ecddcd9c3765037116d1a659bd2867a3456a07bd31bc8615b147fb85b83a74
Size

1.5MB
MD5

3a53f529947ea4a1803e452a700212e3
SHA1

463107be19d8ac3a7705f63ca42f82cacc10c7f3
SHA256

07ecddcd9c3765037116d1a659bd2867a3456a07bd31bc8615b147fb85b83a74
SHA512

8d25ff20bc6ae561aaf91794402f1394842196653d34e93c4d23c066d5ff6a0313bc6013148db6e87187f729f372d02f2bfbe60eea4f24b6307bcf4aff060900
SSDEEP

24576:QyVwrYzd3C84GF3kwwFelT0TKvXrauuK7jc4PUJys0rw+:QyV1RIjwwslTXvRuKIJysKw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07ecddcd9c3765037116d1a659bd2867a3456a07bd31bc8615b147fb85b83a74

Files

07ecddcd9c3765037116d1a659bd2867a3456a07bd31bc8615b147fb85b83a74
.exe windows:4 windows x86 arch:x86

caba1035ee1a624b1454573cd9e74b9a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AllocateAndInitializeSid
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
FreeSid
GetSecurityInfo
GetTokenInformation
InitializeSecurityDescriptor
OpenProcessToken
OpenThreadToken
SetEntriesInAclW
SetSecurityDescriptorDacl

kernel32

AddVectoredExceptionHandler
CancelIo
CloseHandle
ConnectNamedPipe
CreateConsoleScreenBuffer
CreateEventA
CreateEventW
CreateFileW
CreateNamedPipeW
CreateProcessW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetConsoleCP
GetConsoleCursorInfo
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetConsoleTitleW
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetHandleInformation
GetLargestConsoleWindowSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetVersionExW
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReadConsoleInputW
ReadConsoleOutputW
ReadFile
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleTitleW
SetConsoleWindowInfo
SetEvent
SetLastError
SetNamedPipeHandleState
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TransactNamedPipe
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteConsoleInputW
WriteConsoleOutputW
WriteFile

msvcrt

__dllonexit
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_errno
_fmode
_initterm
_iob
_lock
_onexit
_setjmp3
_strdup
_strnicmp
_ultoa
_unlock
_vsnprintf
_write
abort
atoi
calloc
exit
fflush
fopen
fprintf
fputc
fputs
free
fwrite
getenv
islower
isspace
isupper
iswctype
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
setlocale
signal
sprintf
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strrchr
strtoul
strxfrm
towlower
towupper
vfprintf
wcscmp
wcscoll
wcsftime
wcslen
wcsncmp
wcsxfrm

shell32

CommandLineToArgvW

user32

CloseDesktop
CloseWindowStation
CreateDesktopW
CreateWindowStationW
GetDoubleClickTime
GetProcessWindowStation
GetThreadDesktop
GetUserObjectInformationW
MapVirtualKeyW
PostMessageW
SendMessageW
SetProcessWindowStation
VkKeyScanW

Sections

.text
Size: 701KB - Virtual size: 701KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

caba1035ee1a624b1454573cd9e74b9a

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

shell32

user32

Sections

.text Size: 701KB - Virtual size: 701KB

.data Size: 4KB - Virtual size: 4KB

.rdata Size: 65KB - Virtual size: 65KB

/4 Size: 223KB - Virtual size: 222KB

.bss Size: - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 56B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 568KB - Virtual size: 572KB

.text
Size: 701KB - Virtual size: 701KB

.data
Size: 4KB - Virtual size: 4KB

.rdata
Size: 65KB - Virtual size: 65KB

/4
Size: 223KB - Virtual size: 222KB

.bss
Size: - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 568KB - Virtual size: 572KB