e0dd2a18b4a7193b69552787fffce9a2

Sharing

Copy URL Twitter E-mail

General

Target

e0dd2a18b4a7193b69552787fffce9a2
Size

157KB
MD5

e0dd2a18b4a7193b69552787fffce9a2
SHA1

efd24469c78235ee224fadde3ce944305a82326a
SHA256

e46fdc0e6b43328104560d9ba6c326d79f5baa6804cdea87d9d4d700f8848887
SHA512

eb88dfc9ac4a4bc0f85cf07b4196665ea007063452b8e423e6452cb607ac86a36352ce63bbbe5c1cca4f0e7af356e966890ac3fc7cbed525b0b8c8a84bf8547e
SSDEEP

3072:Cj1HktkZfPYga55QlywKGM8wVsHEJ/8Q3N6jtFYIFls:sEtkVFaYlywM8w6EJ/8Q3N6jb0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0dd2a18b4a7193b69552787fffce9a2

Files

e0dd2a18b4a7193b69552787fffce9a2
.exe windows:1 windows x86 arch:x86

a872dc0d9910420479af23c7dbdf4eb6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteW

kernel32

lstrcpyW
lstrlenA
GetFirmwareEnvironmentVariableA
GetLocaleInfoA
DeleteFileW
VirtualFree
Sleep
CreateFileW
EnumSystemCodePagesA
OpenProcess
GetWindowsDirectoryA
FindNextFileA
GetSystemDirectoryW
InitializeCriticalSection
GetConsoleAliasesA
SetMailslotInfo
CreateSemaphoreA
GetCurrentProcess
GetModuleFileNameA
GetLastError
WriteFile
GetTickCount
LZCopy
CreateFileA
lstrcatW
GetFileSizeEx
EnumerateLocalComputerNamesW
GetSystemDefaultLCID
GetConsoleMode
OutputDebugStringW
VirtualQuery
EnterCriticalSection
DuplicateHandle
FindFirstFileA
Module32First
VirtualAlloc
FormatMessageW
SetFileTime
LeaveCriticalSection
lstrcpyA
GetTimeFormatA
LZCreateFileW
CopyFileA
GetSystemDirectoryA
FindClose
EnumSystemLocalesA
FindResourceW
GetModuleHandleA
WriteFileGather
CloseHandle
lstrcatA
DeleteFileA
ReadFile
GetProcAddress
GetStringTypeExA

advapi32

RegQueryValueExA
CryptEncrypt
ObjectDeleteAuditAlarmA
AdjustTokenPrivileges
WmiGetFirstTraceOffset
RegCloseKey
RegEnumValueA
RegSetValueExA
CloseServiceHandle
OpenSCManagerA
EnumServicesStatusA
LookupPrivilegeValueA
SaferSetPolicyInformation
OpenProcessToken
RegOpenKeyA
RegCreateKeyA

ntdll

NtQuerySystemInformation
isspace
ZwLoadDriver
RtlAnsiStringToUnicodeString
RtlInitAnsiString
wcsstr
strstr
NtQueryObject
strncmp
tolower
sprintf
_chkstk
memcpy
strlen
memset
RtlFreeUnicodeString
isdigit
vsprintf

psapi

EnumProcesses
GetProcessImageFileNameA

ws2_32

select
connect
htonl
getnameinfo
socket
getservbyname
recv
send
WSACloseEvent
WSACreateEvent
WSAAsyncGetHostByName
closesocket
__WSAFDIsSet
htons
WSAStartup
gethostbyname

ole32

CoCreateGuid

user32

GetKeyboardLayout
CharLowerW
ExitWindowsEx

Sections

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a872dc0d9910420479af23c7dbdf4eb6

Headers

File Characteristics

Imports

shell32

kernel32

advapi32

ntdll

psapi

ws2_32

ole32

user32

Sections

.data Size: 21KB - Virtual size: 21KB

.text Size: 512B - Virtual size: 404B

.idata Size: 3KB - Virtual size: 2KB

.data
Size: 21KB - Virtual size: 21KB

.text
Size: 512B - Virtual size: 404B

.idata
Size: 3KB - Virtual size: 2KB