d614a4134c9db5d8c2ddd39a5ee2fd7c

General

Target

d614a4134c9db5d8c2ddd39a5ee2fd7c
Size

77KB
MD5

d614a4134c9db5d8c2ddd39a5ee2fd7c
SHA1

4e17d1b427555e8c93c5a30bd0befc6613a823b1
SHA256

e6e6fc07b6d5f721a5e210ce8187ecd125110db0b0c6f707806b18ad1984cc60
SHA512

78a1ca8f948bee7fecde32190d6becaf338582b68c7607c521a27bec9bfaddc7e0b7cf4eb729d3e8c29fd0787b5593758422d960a63108151089b29789941e2b
SSDEEP

1536:LccU4CU+OgS99ZJRql8qaBvTe3NIKAMyWx/2PFDNKz5:4ThU+OXXHq8Te37A42PVs9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d614a4134c9db5d8c2ddd39a5ee2fd7c

Files

d614a4134c9db5d8c2ddd39a5ee2fd7c
.exe windows:4 windows x86 arch:x86

a0ebcb1be5b06660385d0cfde7bd2bfe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumValueW
ControlService
LookupAccountSidW
GetLengthSid
GetSidIdentifierAuthority
CopySid
AddAccessAllowedAce
GetSidSubAuthorityCount
RegQueryValueExW
EqualSid

kernel32

GetTickCount
VirtualAlloc
GetModuleHandleW
GetCurrentProcessId
VirtualFree
GetCurrentThreadId
VirtualLock
GetThreadTimes
SetConsoleIcon
AllocConsole
WriteConsoleW
HeapReAlloc
TerminateProcess

ulib

?QueryScreenSize@SCREEN@@QBEXPAG000@Z
?Sort@STRING_ARRAY@@UAEEE@Z
?DeleteChAt@WSTRING@@QAEXKK@Z
??0PRINT_STREAM@@QAE@XZ
?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z
?Initialize@WSTRING@@QAEEPBDK@Z
?Strstr@WSTRING@@QBEKPBV1@@Z
?Stricmp@WSTRING@@QBEJPBV1@@Z
?QueryChAt@WSTRING@@QBEGK@Z
??0OBJECT@@QAE@ABV0@@Z

ole32

CoFileTimeToDosDateTime
CoAddRefServerProcess
OleFlushClipboard
OleQueryCreateFromData
OleSetContainedObject
OleNoteObjectVisible
OleCreateLinkFromData
CoRevokeMallocSpy
OleDoAutoConvert
OleRegEnumFormatEtc

ntdll

_aullshr
RtlEnumerateGenericTable
ZwWriteVirtualMemory
_ui64toa
RtlIsValidHandle
NtYieldExecution
RtlFindLastBackwardRunClear
_allshl
RtlSetSecurityDescriptorRMControl
strstr

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0ebcb1be5b06660385d0cfde7bd2bfe

Headers

File Characteristics

Imports

advapi32

kernel32

ulib

ole32

ntdll

Sections

.text Size: 72KB - Virtual size: 72KB

.data Size: 2KB - Virtual size: 26KB

.rsrc Size: 1024B - Virtual size: 952B

.text
Size: 72KB - Virtual size: 72KB

.data
Size: 2KB - Virtual size: 26KB

.rsrc
Size: 1024B - Virtual size: 952B