df455a2a292af521c7a162dfbd9cf887

Sharing

Copy URL Twitter E-mail

General

Target

df455a2a292af521c7a162dfbd9cf887
Size

50KB
MD5

df455a2a292af521c7a162dfbd9cf887
SHA1

b303b60d9a3380dc68bda1f8f171918b2bc51b44
SHA256

3a8594a693d4488481718ef50dfc9c27d2a0b032ad505d7310edd880260d705f
SHA512

50862e38d6dfa34723bf583d492f088fca7f08f09fbfaa417448b0c131ab9e841326b61cde94ff5776d4aae8b8832cf1e564e1806185d7280e6c9f703d6c34c2
SSDEEP

1536:e+u47bzXSGtAVgIawE2TRPDZCcpbacxF:ptziJvKchacxF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df455a2a292af521c7a162dfbd9cf887

Files

df455a2a292af521c7a162dfbd9cf887
.exe windows:5 windows x86 arch:x86

b073e24d097a4e0220c1f0e618cebdd7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
CopyFileA
GetTempPathA
ResumeThread
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
CreateFileA
lstrcpyA
GetSystemDirectoryA
GetShortPathNameA
GetModuleFileNameA
ExitProcess
GetVersionExA
DeleteFileA
GetProcAddress
LoadLibraryA
WriteFile
CloseHandle
Sleep
GetLastError
lstrcatA
GetSystemTime
CreateFileW
HeapReAlloc
HeapAlloc
GetStringTypeW
LCMapStringW
MultiByteToWideChar
WriteConsoleW
SetStdHandle
GetModuleHandleW
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapFree
HeapSize
RtlUnwind
FlushFileBuffers

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyA

shell32

ShellExecuteA

ws2_32

socket
connect
send
recv
WSAStartup
htons
gethostbyname

shlwapi

SHDeleteKeyA

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b073e24d097a4e0220c1f0e618cebdd7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ws2_32

shlwapi

Sections

.text Size: 33KB - Virtual size: 33KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 504B

.text
Size: 33KB - Virtual size: 33KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 504B