994a7e805076953f19e1a7b417956407d311643fe4cb71492541595508fa6a64

Sharing

Copy URL Twitter E-mail

General

Target

994a7e805076953f19e1a7b417956407d311643fe4cb71492541595508fa6a64
Size

87KB
MD5

b6c3097319ca1e0e7577075b29c85b9c
SHA1

f5a01bdc21e3127d0c6126a9e19dba89fc5e2fc8
SHA256

994a7e805076953f19e1a7b417956407d311643fe4cb71492541595508fa6a64
SHA512

2a9d3d87e376c4eb954723f03cda39082f448327f85a47e7e02178fc1f0a8469806a225730e77900b263939c97b394426705ade702ca2a2a53464cb1bb168f03
SSDEEP

1536:0roBgRUUWpnrb5JXpXPNyx0IBIRViOtODnBaDbX77UnGBLttP+xLiZLk:4oCUUWprlNp/ViaYBiKGBLttP+xLiZL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
994a7e805076953f19e1a7b417956407d311643fe4cb71492541595508fa6a64

Files

994a7e805076953f19e1a7b417956407d311643fe4cb71492541595508fa6a64
.exe windows:5 windows x86 arch:x86

f9f76ff44fc791b200cd48013a575783

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetLastError
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
Sleep
DeleteFileA
CloseHandle
GetFileSize
WaitForSingleObject
FreeLibrary
CreateFileA
ExpandEnvironmentStringsA
GetTickCount
CreateMutexA
SetEndOfFile
CreateFileW
GetStringTypeW
CreateProcessA
OutputDebugStringA
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
ReadFile
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
ExitProcess
HeapCreate
GetModuleFileNameW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
WriteConsoleW
HeapReAlloc
LoadLibraryW
GetProcessHeap

wininet

InternetTimeFromSystemTime
InternetSetCookieA
InternetQueryOptionA
InternetSetOptionA

ws2_32

WSAStartup

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9f76ff44fc791b200cd48013a575783

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

wininet

ws2_32

iphlpapi

Sections

.text Size: 60KB - Virtual size: 60KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 12KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 60KB - Virtual size: 60KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 12KB

.reloc
Size: 6KB - Virtual size: 5KB