d54b20a00903860a62f66c1f40504b59

Sharing

Copy URL Twitter E-mail

General

Target

d54b20a00903860a62f66c1f40504b59
Size

1024KB
MD5

d54b20a00903860a62f66c1f40504b59
SHA1

8a1915143ef84218198f8f6e886179a20720dbae
SHA256

5358ca3d7a307ccebd16288d2c8edd063fc38d0cfd8f1ec79415055e8dee8024
SHA512

592f5b94aed3d91ca0b510a6e049a43c1b6fc452948f17b4770a7cb1058f33f12efcf68f72bf8d59e9439b73f7f4248499397605ac2b6c786fa00b8107a18169
SSDEEP

24576:5ooehoIa5NArZqUjqfJYXQMWlW0X17bsaTN96P4/QYZ/f+b7JE:5Rehe5NoZqqqfJYAMeW0XBbD96P4tZG+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d54b20a00903860a62f66c1f40504b59

Files

d54b20a00903860a62f66c1f40504b59
.exe windows:5 windows x86 arch:x86

7b2c4235a00e08021049cd62a817afc5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
lstrlenW
WideCharToMultiByte
MoveFileExW
GetTempFileNameW
GetTempPathW
DeleteFileW
MoveFileW
WriteFile
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
Sleep
GetModuleFileNameW
GetComputerNameA
GetSystemTime
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetCurrentThreadId
SetUnhandledExceptionFilter
ExitProcess
DecodePointer
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
EncodePointer
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapReAlloc
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
MultiByteToWideChar
FreeLibrary
InterlockedExchange
GetStringTypeW
SetStdHandle
WriteConsoleW
SetEndOfFile
GetProcessHeap
CloseHandle
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
GetModuleHandleA
CreateProcessW
LoadLibraryW
SystemTimeToFileTime
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LoadLibraryA
TlsGetValue
GetProcAddress
LocalAlloc

advapi32

CreateServiceW
RegSetValueExW
RegCreateKeyExW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
StartServiceW
CloseServiceHandle
RegCloseKey
RegOpenKeyExW
CryptAcquireContextW
CryptReleaseContext
GetUserNameW
GetUserNameA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryValueExW

ole32

CoCreateInstance
CoInitialize

shlwapi

PathAddExtensionW
PathAppendW
PathRemoveExtensionW
PathFileExistsW
PathIsRootW

Sections

.text
Size: 391KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.const
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 702KB - Virtual size: 723KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b2c4235a00e08021049cd62a817afc5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

shlwapi

Sections

.text Size: 391KB - Virtual size: 391KB

.const Size: 8KB - Virtual size: 8KB

.data Size: 702KB - Virtual size: 723KB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 391KB - Virtual size: 391KB

.const
Size: 8KB - Virtual size: 8KB

.data
Size: 702KB - Virtual size: 723KB

.rsrc
Size: 2KB - Virtual size: 2KB