3196766c42177bd1a2bad7ca285b4b4cbb15caa88cfcc74672233fdfbdca792e

General

Target

3196766c42177bd1a2bad7ca285b4b4cbb15caa88cfcc74672233fdfbdca792e
Size

41KB
MD5

66993dfde63e1f6865675145789a38b6
SHA1

1bff006cb0201c815249c899f869a2cf4bd49995
SHA256

3196766c42177bd1a2bad7ca285b4b4cbb15caa88cfcc74672233fdfbdca792e
SHA512

da3cc9ec9ba0e6376bf8c73d0d1ca648ff580689039a163cfa5d77d6e794e7654812d583633fd26bdec37766a11ceba37cec1d10d97afcff5f549b1afd916fcc
SSDEEP

768:Pf+Fn+PDdK8CMeIVKGucOyGAwggggggLvggggggggSaSQPndkV1K:Pf+Is8CMdicOWuSJC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3196766c42177bd1a2bad7ca285b4b4cbb15caa88cfcc74672233fdfbdca792e

Files

3196766c42177bd1a2bad7ca285b4b4cbb15caa88cfcc74672233fdfbdca792e
.exe windows:4 windows x86 arch:x86

58513824c990be56f1e07213c3610d56

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

jefri.pdb

Imports

shell32

SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetFileInfoA
StrChrA
SHChangeNotify
SHGetMalloc
ShellMessageBoxW
FreeIconList
SHGetFolderPathA
DragFinish
SHCreateShellItem
ExtractIconA
SHFileOperationA

wtsapi32

WTSEnumerateServersA
WTSTerminateProcess
WTSFreeMemory
WTSRegisterSessionNotification
WTSVirtualChannelRead
WTSUnRegisterSessionNotification
WTSEnumerateProcessesA
WTSLogoffSession
WTSEnumerateSessionsA
WTSVirtualChannelWrite
WTSSendMessageA
WTSQueryUserToken
WTSQuerySessionInformationA

dciman32

DCICreateOverlay
DCICloseProvider
DCIBeginAccess
DCIDestroy
DCIEnum

kernel32

lstrcpynW
GetSystemTime
ReplaceFileA
GetModuleHandleW
GetStringTypeA
SetErrorMode
FindFirstFileA
ReadConsoleW
GetProcAddress
GetLocalTime
WriteConsoleA
DeviceIoControl
GetLastError
GetPrivateProfileIntW
GetPrivateProfileIntW
GetStdHandle
SearchPathA
FindNextVolumeW
GetTickCount
IsBadStringPtrA
lstrcmpiA
CompareStringW
SetEnvironmentVariableW
FoldStringA

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58513824c990be56f1e07213c3610d56

Headers

File Characteristics

PDB Paths

Imports

shell32

wtsapi32

dciman32

kernel32

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 2KB

.rsrc Size: 11KB - Virtual size: 11KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 11KB - Virtual size: 11KB