0d133ea8098e3802bf74202e4d25d6e151fbbd1b787ed08e063bd678166da8c1

Sharing

Copy URL Twitter E-mail

General

Target

0d133ea8098e3802bf74202e4d25d6e151fbbd1b787ed08e063bd678166da8c1
Size

423KB
MD5

7f953c6988d829c9c4ac2002572c9055
SHA1

f9f8eb35cbf7bb8caf5f1dffd07a16412a593e87
SHA256

0d133ea8098e3802bf74202e4d25d6e151fbbd1b787ed08e063bd678166da8c1
SHA512

d7469f451fb757efe8d5d095a4e6d95da99070f91f1d24bc823d4dcae84be3b294d27dbac3690497c814cd4137d9faed56e5c653d6eba815b2aa2aefcbd0f8f0
SSDEEP

6144:RT9zCkyZpDy/XMIn17wpQw3zL35qytvTkDk4pykcpqJQNj3mrjBUIrc8mlp32MDj:RT9zCtZtuo33rNTyPfJA2r3ctWMDj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d133ea8098e3802bf74202e4d25d6e151fbbd1b787ed08e063bd678166da8c1

Files

0d133ea8098e3802bf74202e4d25d6e151fbbd1b787ed08e063bd678166da8c1
.exe windows:6 windows x64 arch:x64

88e531e3d0937e83960372f6b1ac870b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WideCharToMultiByte
CreateRemoteThread
LocalFree
GetFileTime
VirtualAllocEx
GetProcAddress
CloseHandle
Process32Next
DeleteFileW
GetVersionExA
CreateFileA
GetLastError
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
GetSystemDirectoryW
CreateFileW
LocalAlloc
SetFilePointer
SetFileTime
WriteFile
GetCurrentProcess
WriteProcessMemory
Process32First
GetModuleFileNameA
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
GetModuleFileNameW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetFileType
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
SetFilePointerEx
WriteConsoleW
ReadFile

advapi32

SystemFunction036
CryptDestroyHash
CryptHashData
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
LookupPrivilegeValueA
RegSetValueExW
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
CryptDestroyKey
CryptAcquireContextA
CryptEncrypt
CryptCreateHash
CryptDeriveKey
CryptReleaseContext

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88e531e3d0937e83960372f6b1ac870b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 94KB - Virtual size: 94KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 2KB - Virtual size: 16KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 94KB - Virtual size: 94KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 2KB - Virtual size: 16KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB