969ac3517ae9c472e436c547a6721f426a675ad8dece53c3f8e79ba44aa884eb

Sharing

Copy URL Twitter E-mail

General

Target

969ac3517ae9c472e436c547a6721f426a675ad8dece53c3f8e79ba44aa884eb
Size

257KB
MD5

075ba8e8b03e3147a8f3d71e9f8a53c9
SHA1

97776ebac5794ae60b82d2a55f9aa255ea407b82
SHA256

969ac3517ae9c472e436c547a6721f426a675ad8dece53c3f8e79ba44aa884eb
SHA512

832bf316dda68fb678080564205e5432d5fea52b1eb624812015165eda2084f326d16c3d9aa9daf6a48412044cccac1fe992a1c8e49bd47817592533b1831004
SSDEEP

6144:MGcwfQaNYZwxBM1eMYHKCHa3q2YfnEqRgu:MfwYaNYZwxBSVfqaa28EqKu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
969ac3517ae9c472e436c547a6721f426a675ad8dece53c3f8e79ba44aa884eb

Files

969ac3517ae9c472e436c547a6721f426a675ad8dece53c3f8e79ba44aa884eb
.exe windows:6 windows x86 arch:x86

ca9299048171178526bc36cf29887d4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Administrator\Documents\Visual Studio 2015\Projects\mmmmmmm\Release\mmmmmmm.pdb

Imports

kernel32

VirtualProtect
GetCurrentProcess
WriteFile
InitializeProcThreadAttributeList
FindResourceA
LocalAlloc
GetModuleHandleA
FreeResource
OpenProcess
CreateToolhelp32Snapshot
UpdateProcThreadAttribute
Process32First
LockResource
Process32Next
CloseHandle
K32GetModuleInformation
LoadResource
DeleteProcThreadAttributeList
QueueUserAPC
GetProcAddress
CreateFileMappingA
LocalFree
MapViewOfFile
SizeofResource
CreateFileA
ReadFile
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
UnhandledExceptionFilter

advapi32

GetUserNameA
CreateProcessAsUserA

shell32

ShellExecuteA

vcruntime140

memset
_except_handler4_common
memcpy

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_seh_filter_exe
_crt_atexit
_controlfp_s
terminate
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_c_exit
__p___argv
__p___argc
_set_app_type
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_configure_narrow_argv
_cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca9299048171178526bc36cf29887d4f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 900B

.gfids Size: 512B - Virtual size: 32B

.rsrc Size: 246KB - Virtual size: 245KB

.reloc Size: 512B - Virtual size: 484B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 900B

.gfids
Size: 512B - Virtual size: 32B

.rsrc
Size: 246KB - Virtual size: 245KB

.reloc
Size: 512B - Virtual size: 484B