58151a22f71e133db0d646ee3f2cf55aa0f2391e8b697a8f79ba8ac95d83a626

General

Target

58151a22f71e133db0d646ee3f2cf55aa0f2391e8b697a8f79ba8ac95d83a626
Size

1.0MB
MD5

052dc2c91b402f1b33e51af5199583a1
SHA1

78ae5845ebe812a644ba5f826f582eaf6a01c016
SHA256

58151a22f71e133db0d646ee3f2cf55aa0f2391e8b697a8f79ba8ac95d83a626
SHA512

6911f5e8d40a045f015dfeee029378477ec42511005941b766a75220bb15a4ae38350d814c75d8625f0dc61525098647f8adcb32a9817382c3569deda5181810
SSDEEP

24576:9gjxqyBghb/swbtipSFVLepfc8y4s6EOIPrrylyNHJgsL3:Sjx1Shb/swMpW61rs6EOITrylyNHJd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
58151a22f71e133db0d646ee3f2cf55aa0f2391e8b697a8f79ba8ac95d83a626

Files

58151a22f71e133db0d646ee3f2cf55aa0f2391e8b697a8f79ba8ac95d83a626
.exe windows:6 windows x64 arch:x64

f29b29c8b7c5707c6c76f7cffa12a582

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

memmove
RtlSleepConditionVariableSRW
RtlWakeAllConditionVariable
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
strcmp
wcslen
memcmp
strncmp
strlen
strcpy
strcat
strstr
strrchr
memset
__chkstk
memcpy

kernel32

GetTickCount64
GetLastError
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
GetPriorityClass
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
Sleep
GetCurrentThreadId

gdi32

CreateCompatibleDC
GetDIBits
GetDeviceCaps
TextOutW
MoveToEx
SetTextColor
StretchDIBits
SetBkMode
SetBkColor
SelectObject
Rectangle
LineTo
DeleteObject
DeleteDC
CreateSolidBrush
CreatePen
CreateFontW
BitBlt
CreateCompatibleBitmap

Sections

.text
Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 259KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f29b29c8b7c5707c6c76f7cffa12a582

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

gdi32

Sections

.text Size: 428KB - Virtual size: 428KB

.rdata Size: 290KB - Virtual size: 289KB

.data Size: 41KB - Virtual size: 50KB

.pdata Size: 8KB - Virtual size: 7KB

.rsrc Size: 259KB - Virtual size: 259KB

.reloc Size: 512B - Virtual size: 16B

.text
Size: 428KB - Virtual size: 428KB

.rdata
Size: 290KB - Virtual size: 289KB

.data
Size: 41KB - Virtual size: 50KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 259KB - Virtual size: 259KB

.reloc
Size: 512B - Virtual size: 16B