df73da8b38323f4fc3e396e6a2bee79a

Sharing

Copy URL Twitter E-mail

General

Target

df73da8b38323f4fc3e396e6a2bee79a
Size

86KB
MD5

df73da8b38323f4fc3e396e6a2bee79a
SHA1

614daef87807cb7b1d3b8285186b6846d5b586b8
SHA256

5aad7045fdcea2eca03cdc481c504ba2645d04b24c171a1ead794aabe6fab8d1
SHA512

2402876cf972b6b743e5ed3a081e5a43e769d532ee6c1fbf5fcd724332c7b268b916005d2244371c39466b7a240a058047efc5295586bead150131818af4d882
SSDEEP

1536:XuKRL57fht+L5PtBY6BF4WKyjL2BnH58rhakgVzVIKgPV7PRMp0Z0Bwy:XuKD7ps5PtiO5/k58rhiVzVIBtRMhr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df73da8b38323f4fc3e396e6a2bee79a

Files

df73da8b38323f4fc3e396e6a2bee79a
.exe windows:5 windows x86 arch:x86

9f3c99f18cb38f08a65f7ab701426251

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
CreateFileW
GetStringTypeW
LCMapStringW
LoadLibraryW
HeapSize
CloseHandle
IsProcessorFeaturePresent
HeapReAlloc
RtlUnwind
WriteConsoleW
MultiByteToWideChar
IsValidCodePage
CompareStringW
SetEnvironmentVariableA
GetOEMCP
GetACP
HeapCreate
GetLastError
GetTickCount
GetCurrentProcess
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
WideCharToMultiByte
GetTimeZoneInformation
SetStdHandle
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetProcAddress
Sleep
ExitProcess
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
SetFilePointer
GetCPInfo

user32

DestroyWindow
GetMessageA
SetCapture
LoadIconA
GetClientRect
TranslateMessage
LoadAcceleratorsA
DispatchMessageA
CloseWindow
DialogBoxParamA
GetScrollPos

winspool.drv

ClosePrinter

comdlg32

PrintDlgA

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f3c99f18cb38f08a65f7ab701426251

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winspool.drv

comdlg32

Sections

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 27KB - Virtual size: 34KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 27KB - Virtual size: 34KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 4KB - Virtual size: 3KB