8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91

Resubmissions

09-04-2024 10:06

240409-l5bmdacc75 7

09-04-2024 10:05

09-04-2024 10:05

09-04-2024 10:05

29-01-2024 04:54

Sharing

Copy URL

Twitter E-mail

General

Target

8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91
Size

1.9MB
MD5

d5057eda9b4251e0e52fb2d8524cfa57
SHA1

327f6d72563fdfb1ab206ac9a3b2d4c770d066f5
SHA256

8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91
SHA512

24d423aa3d71b12af016c5918940d4984f1640f902dc36adc9a29dd9980baa2210ea250111b052dc9fdc5cdfbea8ece8813494f2d2ccecefa60f224a3d731fb2
SSDEEP

24576:OPUnujryKC12iAlGaRctykklEPjJ3QIzs6yBKSolGIUOVPgJAt8EnZapKtpMh6co:9Dr2iAcKcC+N3Bs6ywSz5SSAza88hqx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91

Files

8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91
.exe windows:5 windows x86 arch:x86

6772a34575cedb2362e5464a0a60f25f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\wapinobepegote\vic\felidobudod bohene20\kacedujofej\dep\hev.pdb

Imports

kernel32

GetSystemDefaultLangID
FillConsoleOutputCharacterA
GetConsoleAliasesLengthW
FindResourceW
InterlockedDecrement
FindCloseChangeNotification
MoveFileWithProgressA
GetTickCount
VirtualFree
GetConsoleAliasesLengthA
ReadConsoleW
LoadLibraryW
FreeConsole
GetModuleFileNameW
SetComputerNameExW
GetStartupInfoW
CreateJobObjectA
GetLastError
SetLastError
ReadConsoleOutputCharacterA
GetProcAddress
VirtualAlloc
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
MoveFileA
FindFirstVolumeMountPointW
RemoveDirectoryW
QueryDosDeviceW
GlobalFindAtomW
GetModuleHandleA
GetStringTypeW
PurgeComm
GetFileAttributesExW
SetCalendarInfoA
GetCurrentProcessId
DebugBreak
DeleteFileA
MultiByteToWideChar
GetModuleHandleW
Sleep
ExitProcess
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
RaiseException
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetLocaleInfoA
HeapAlloc
HeapReAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
HeapSize
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
CreateFileA

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

6772a34575cedb2362e5464a0a60f25f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 20KB - Virtual size: 4.1MB

.rsrc Size: 80KB - Virtual size: 80KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 20KB - Virtual size: 4.1MB

.rsrc
Size: 80KB - Virtual size: 80KB