becedfdb6c118042a4220a6eb8398f51dc304796deef881ba79f54ddcb9b3f5a

Sharing

Copy URL

Twitter E-mail

General

Target

becedfdb6c118042a4220a6eb8398f51dc304796deef881ba79f54ddcb9b3f5a
Size

245KB
MD5

372251e06450ff07334e5ac9d25e654e
SHA1

a1a97acc8f1deef32026ca3f065c3dd9c3f1a823
SHA256

becedfdb6c118042a4220a6eb8398f51dc304796deef881ba79f54ddcb9b3f5a
SHA512

fd2e5a6090e1553205f0a7172bf1005266891074f96df17b1bd508104857d797c425ff60a87a83f8784a9502b3221a565d7184ea8cba99818ba7b40b46465b7b
SSDEEP

3072:kr9tWs5QNHJlt8Tujo1raQ/aDmtRljino5pBnKeMMKxy8AN4p8SU6x:AtWs5QNcuj7QHqGBkxANNNo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
becedfdb6c118042a4220a6eb8398f51dc304796deef881ba79f54ddcb9b3f5a

Files

becedfdb6c118042a4220a6eb8398f51dc304796deef881ba79f54ddcb9b3f5a
.exe windows:5 windows x86 arch:x86

369a94afcf18c780ae9951d0383de891

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToDosDateTime
CreateFileA
GetLocaleInfoA
HeapAlloc
InterlockedIncrement
SystemTimeToFileTime
ReadConsoleOutputAttribute
HeapFree
SetComputerNameW
SetEvent
GetNumaAvailableMemoryNode
GlobalAlloc
GlobalFindAtomA
LoadLibraryW
GetFileAttributesA
LocalReAlloc
GetModuleFileNameW
FindNextVolumeMountPointW
SetThreadLocale
GetLastError
GetProcAddress
HeapSize
GetAtomNameA
UnhandledExceptionFilter
SetCalendarInfoW
FindAtomA
CreatePipe
SetConsoleTitleW
GetCurrentDirectoryA
GetProfileSectionW
CreateFileW
EncodePointer
DecodePointer
GetModuleHandleW
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
HeapCreate
EnterCriticalSection
LeaveCriticalSection
Sleep
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
MultiByteToWideChar
HeapReAlloc
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
IsProcessorFeaturePresent
FlushFileBuffers
ReadFile
CloseHandle

user32

GetMonitorInfoW

winhttp

WinHttpOpen

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

369a94afcf18c780ae9951d0383de891

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winhttp

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 92KB - Virtual size: 91KB

.data Size: 10KB - Virtual size: 258KB

.rsrc Size: 106KB - Virtual size: 106KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 92KB - Virtual size: 91KB

.data
Size: 10KB - Virtual size: 258KB

.rsrc
Size: 106KB - Virtual size: 106KB