d53d6323ef95e19791c2a83fecc53dc8

Sharing

Copy URL Twitter E-mail

General

Target

d53d6323ef95e19791c2a83fecc53dc8
Size

51KB
MD5

d53d6323ef95e19791c2a83fecc53dc8
SHA1

e47ab403d083c1d14f092a5923a392a60aa00cb2
SHA256

3c86058fca259215a0a294244a6f2d353a5319ffc5dc299d86a4599258eda476
SHA512

e058c6bc6d6e899a594aaf832305fdd9f9dd5ff2aaf1d1a9c8f45dd6ff1b033be3593f09c9c5d3c2de1b1573bee5ff206bf26a45fef72688f666085cccd45100
SSDEEP

768:SJSTpvyeOed3vovUo/GIBLFv4PeV6vIShzz6rdgRp5h:S0TLvA8o/GIBxgPb2k5h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d53d6323ef95e19791c2a83fecc53dc8

Files

d53d6323ef95e19791c2a83fecc53dc8
.exe windows:5 windows x86 arch:x86

c4fd74dcb4e602337f5d2e6cc824ffc3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Users\Administrator\Desktop\Kill_KIS8\Kill_KIS8\Release\Kill_KIS8.pdb

Imports

kernel32

GetProcessHeap
OpenProcess
lstrcpynW
GetLastError
GetProcAddress
Process32FirstW
GetModuleHandleW
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
DuplicateHandle
CloseHandle
GetCurrentProcessId
HeapFree
GetCurrentProcess
CreateEventW
HeapAlloc
CreateFileA
SetStdHandle
WriteConsoleW
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
HeapSize
WriteConsoleA
GetConsoleOutputCP

advapi32

GetTokenInformation
OpenProcessToken
LookupAccountSidW

ntdll

NtQueryObject
RtlEqualUnicodeString
RtlInitUnicodeString
NtQuerySystemInformation
RtlUnwind

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4fd74dcb4e602337f5d2e6cc824ffc3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ntdll

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 436B