e1c71000a00656652241ee6ebb76a44c

General

Target

e1c71000a00656652241ee6ebb76a44c
Size

782KB
MD5

e1c71000a00656652241ee6ebb76a44c
SHA1

23afd32d1bf6e2cf6bdc7a0b00ca8b0e0b4ec8bb
SHA256

ff4adfc1a4257d7aa664cfda735dd893545cca884c751a520480f868ea2ee42e
SHA512

227e256f77e9074def10d0e839fcf6d25bbd235254e2d7d004c4525ff331dc221629a669613e2c6325fbeed257bf6c24b324904c21702daf4621ededecab86e5
SSDEEP

6144:SlyWX8D7edjeyirwS5/NllSuWF5KvQ8HWQEqmkxO9ob4sZGiSP2Re8J2:SlyWX8D7ujepLOuiAI82QEqmsO9o5/k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1c71000a00656652241ee6ebb76a44c

Files

e1c71000a00656652241ee6ebb76a44c
.exe windows:4 windows x86 arch:x86

891a52d771969131956b4ab4cbbf21e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\283428348239048239429384.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
GetLocalTime
GetSystemTimeAsFileTime
FileTimeToSystemTime
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
DebugBreak
RaiseException
HeapAlloc
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
HeapReAlloc
HeapFree
GetLastError
HeapDestroy
HeapCreate
VirtualFree
TerminateProcess
GetCurrentProcess
ExitProcess
VirtualAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
RtlUnwind
GetProcessHeap
CloseHandle
FreeLibrary
SetConsoleCtrlHandler
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
VirtualQuery
InterlockedExchange
SetFilePointer
VirtualProtect
GetSystemInfo
GetLocaleInfoA
LCMapStringA
LCMapStringW
SetStdHandle
FlushFileBuffers

gdi32

CreateBitmap

Sections

.rda9842
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 184KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

891a52d771969131956b4ab4cbbf21e1

Headers

File Characteristics

PDB Paths

Imports

kernel32

gdi32

Sections

.rda9842 Size: 64KB - Virtual size: 64KB

.text Size: 88KB - Virtual size: 84KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 184KB - Virtual size: 238KB

.idata Size: 4KB - Virtual size: 2KB

.rda9842
Size: 64KB - Virtual size: 64KB

.text
Size: 88KB - Virtual size: 84KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 184KB - Virtual size: 238KB

.idata
Size: 4KB - Virtual size: 2KB