3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887

Resubmissions

22/09/2021, 14:16 UTC

210922-rk974afedl 10

Sharing

Copy URL

Twitter E-mail

General

Target

3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
Size

566KB
MD5

7e8b9cf70707293f8950b2151a3c16f4
SHA1

c925e491311dc75e2c8a7c05d7deb608c95b4e51
SHA256

3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
SHA512

6059abc60ecd8f67dc4d80a189aa9b8631204dc7b38936f3ee0735eb3030ceefb08fba14a492978afe2191fd35ac17c705317dc5c83a216bce23b0b58533630c
SSDEEP

12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvW0:pjOMtd1a/yl3KOjb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887

Files

3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
.exe windows:4 windows x86 arch:x86

174266963e9a11ce6878050b21579fcf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetLastError
GetModuleHandleA
VirtualAlloc
GetModuleFileNameA
ResetEvent
SetLastError
MultiByteToWideChar
ReadFile
InterlockedCompareExchange
LocalAlloc
OutputDebugStringW
QueryPerformanceFrequency
EncodePointer
CreateEventW
SetEvent
QueryPerformanceCounter
LoadLibraryA
GetFileAttributesW
lstrcpynW
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetTickCount
GetSystemTimeAsFileTime
RaiseException
WaitForMultipleObjects
DecodePointer
GetCommandLineW
InterlockedExchange
ExitProcess
GetTempFileNameW
FreeLibrary
SetUnhandledExceptionFilter
GetCurrentProcess
CreateDirectoryW
WaitForSingleObject
LoadLibraryW
CreateFileW
GetProcAddress
GetCurrentThreadId
CloseHandle
DeleteFileW
GetCurrentProcessId
CreateThread
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
DeleteCriticalSection
WriteFile
GetModuleFileNameW
GetFileSizeEx
GetLocalTime
LocalFree
OpenMutexW
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
CreateMutexW
ReleaseMutex
InterlockedDecrement
GetModuleHandleW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
WideCharToMultiByte
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetStdHandle

user32

GetClipboardData
CharNextA
GetWindowDC
GetAsyncKeyState
IsMenu
IsCharAlphaNumericW
CharLowerA
IsCharLowerA
DestroyIcon
GetTopWindow
IsGUIThread
OpenIcon
GetMenu
EnumClipboardFormats
GetMenuItemCount
GetKeyState
LoadCursorW
GetKeyboardLayout
wsprintfW

gdi32

DeleteObject
GetStockObject
FlattenPath
GetDCBrushColor
EndPage
CreateHalftonePalette
AbortPath
WidenPath
GetEnhMetaFileW
GetEnhMetaFileBits

advapi32

RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
StartServiceW
QueryServiceStatusEx

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
Shell_NotifyIconW
ShellExecuteW
ShellExecuteExW
SHFileOperationW
SHLoadNonloadedIconOverlayIdentifiers
DragAcceptFiles
SHQueryRecycleBinA
SHBrowseForFolder
ShellExecuteEx
ExtractAssociatedIconExA
DragFinish
SHGetMalloc
SHChangeNotify
SHBrowseForFolderA
DragQueryFileW
SHGetSpecialFolderPathA
ExtractAssociatedIconExW
CheckEscapesW
ExtractIconW
FindExecutableW
DoEnvironmentSubstA
SHInvokePrinterCommandA
SHGetIconOverlayIndexA
SHCreateDirectoryExA
SHCreateProcessAsUserW

shlwapi

PathAppendW
PathRemoveFileSpecW
AssocQueryStringW
StrStrIA
StrRStrIA
StrChrA
StrChrIA
StrRChrIA
StrRChrW
StrStrIW
SHSetValueW
SHGetValueW

Sections

.text
Size: 387KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text3
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text2
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data3
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

174266963e9a11ce6878050b21579fcf

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

Sections

.text Size: 387KB - Virtual size: 386KB

.text3 Size: 107KB - Virtual size: 107KB

.text2 Size: 20KB - Virtual size: 19KB

.data Size: 25KB - Virtual size: 25KB

.data3 Size: 20KB - Virtual size: 19KB

.rsrc Size: 5KB - Virtual size: 5KB

We care about your privacy.

.text
Size: 387KB - Virtual size: 386KB

.text3
Size: 107KB - Virtual size: 107KB

.text2
Size: 20KB - Virtual size: 19KB

.data
Size: 25KB - Virtual size: 25KB

.data3
Size: 20KB - Virtual size: 19KB

.rsrc
Size: 5KB - Virtual size: 5KB