cc3bd39e04a4a2728f7b1f20e805263240da32729cbd064df63e24be6869763c

Sharing

Copy URL Twitter E-mail

General

Target

cc3bd39e04a4a2728f7b1f20e805263240da32729cbd064df63e24be6869763c
Size

87KB
MD5

141f2b8252d9d0d63844dcc64735b693
SHA1

411f2e5166e1838b36c909b0abfc110223a8bdf3
SHA256

cc3bd39e04a4a2728f7b1f20e805263240da32729cbd064df63e24be6869763c
SHA512

0341a62935b4529a1cfac67222f376c2410990490ee4dc0aec1eb16c1023fe2fdc23811c0c733839d29830f28ca2335f73501d3ac6d319733309a075bbcc74e1
SSDEEP

1536:/Nlowi0NqN8gIRaOGahsKapk4GLWQUckOcD4MTCRKFegdi2OyRek:/N/ZUmgIRndSzxOBK4EZpRek

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc3bd39e04a4a2728f7b1f20e805263240da32729cbd064df63e24be6869763c

Files

cc3bd39e04a4a2728f7b1f20e805263240da32729cbd064df63e24be6869763c
.exe windows:5 windows x86 arch:x86

2624d22cc95480a68d1f04fec0589981

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
ExpandEnvironmentStringsA
WaitForSingleObject
DeleteFileA
SetFilePointer
CreateProcessA
GetProcAddress
LoadLibraryA
GetTickCount
Sleep
GetModuleFileNameA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateToolhelp32Snapshot
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
Process32First
OpenProcess
Process32Next
GetProcessHeap
HeapAlloc
HeapFree
LocalFree
GetCurrentProcess
GetLastError
CreateFileA
GetFileSize
CloseHandle
HeapSize
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
LCMapStringW
ReadFile
RtlUnwind
ExitThread
GetCurrentThreadId
CreateThread
RaiseException
GetCommandLineA
GetStartupInfoA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId

user32

DestroyWindow
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
LoadStringA
SendMessageTimeoutA
RegisterClassExA
LoadCursorA
SetClipboardViewer
SendMessageA
UpdateWindow
PostQuitMessage
ChangeClipboardChain
DefWindowProcA
CreateWindowExA
ShowWindow

advapi32

RegOpenKeyExA
RegOpenKeyA
GetTokenInformation
EqualSid
ConvertSidToStringSidA
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA

ole32

CoCreateGuid

wininet

InternetConnectA
InternetCloseHandle
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetOpenA

shlwapi

SHRegGetValueA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2624d22cc95480a68d1f04fec0589981

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

wininet

shlwapi

iphlpapi

Sections

.text Size: 66KB - Virtual size: 66KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 796B

.text
Size: 66KB - Virtual size: 66KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 796B