1c7804155248e2596ec9de97e5cddcddbafbb5c6d066d972bad051f81bbde5c4

Sharing

Copy URL Twitter E-mail

General

Target

1c7804155248e2596ec9de97e5cddcddbafbb5c6d066d972bad051f81bbde5c4
Size

304KB
MD5

19e4f506b8b735aeffc51fceaa761317
SHA1

1eba56e89d89d42154c9c30531abc2ba0477af2c
SHA256

1c7804155248e2596ec9de97e5cddcddbafbb5c6d066d972bad051f81bbde5c4
SHA512

ae332c6418602aa8a44c51f997a9c338d69080c0a395a7818896e5e730aca8bd8cd16d3a8fc2db677862e83b9396dccfba2cd307f858014adc5b9134354584c4
SSDEEP

6144:6zHGRMRXQLOuuCTVHydIURtk1q3TV5TQYr1kN5AO0yRhy:piRXQLOuugydIURtk1q6JR4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c7804155248e2596ec9de97e5cddcddbafbb5c6d066d972bad051f81bbde5c4

Files

1c7804155248e2596ec9de97e5cddcddbafbb5c6d066d972bad051f81bbde5c4
.exe windows:6 windows x86 arch:x86

2c0d88a4f32c92b935c48dcd8eada817

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AccessCheck
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
DuplicateToken
GetCurrentHwProfileA
GetFileSecurityA
GetFileSecurityW
GetUserNameA
GetUserNameW
MapGenericMask
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegSetValueExW

ws2_32

WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
inet_ntoa

crypt32

CryptBinaryToStringA

wininet

HttpAddRequestHeadersA
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetGetConnectedState
InternetOpenA
InternetQueryDataAvailable
InternetReadFile
InternetSetOptionA

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetMessageW
RegisterClassW
TranslateMessage
UnregisterClassW

kernel32

CloseHandle
CompareStringW
CopyFileW
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileW
CreateProcessA
CreateThread
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFileA
DeleteFileW
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameA
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDriveTypeW
GetEnvironmentStringsW
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetLastError
GetLocaleInfoW
GetLogicalDrives
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetVolumeInformationA
GetVolumeInformationW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MapViewOfFile
MoveFileA
MoveFileExW
MultiByteToWideChar
OpenProcess
Process32FirstW
Process32NextW
QueryFullProcessImageNameW
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ResetEvent
RtlUnwind
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

Sections

.text
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 366B

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c0d88a4f32c92b935c48dcd8eada817

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

crypt32

wininet

shell32

user32

kernel32

Sections

.text Size: 225KB - Virtual size: 224KB

.rdata Size: 59KB - Virtual size: 59KB

.data Size: 7KB - Virtual size: 10KB

.00cfg Size: 512B - Virtual size: 4B

.tls Size: 512B - Virtual size: 9B

.voltbl Size: 512B - Virtual size: 366B

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 225KB - Virtual size: 224KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 7KB - Virtual size: 10KB

.00cfg
Size: 512B - Virtual size: 4B

.tls
Size: 512B - Virtual size: 9B

.voltbl
Size: 512B - Virtual size: 366B

.reloc
Size: 9KB - Virtual size: 9KB