df7d6129ceb726b6e01762404f768aa2a4bca2366b7e32d93c1a6ef56d4bd5b6

Sharing

Copy URL Twitter E-mail

General

Target

df7d6129ceb726b6e01762404f768aa2a4bca2366b7e32d93c1a6ef56d4bd5b6
Size

851KB
MD5

23e17bc0ed5de8c26fc0d371d64c3b2c
SHA1

a1f40ed9e90a8d55e3a5167b20191291de65b7f5
SHA256

df7d6129ceb726b6e01762404f768aa2a4bca2366b7e32d93c1a6ef56d4bd5b6
SHA512

018d9cfc145b98ff75d4cbc050733448bef77a0d3bbcbe94c3092fb9f5d1369ba8b4c3889cd6aae25a78adcb58ae131a53a695ede1c3cd2bf0593fe31f56e19b
SSDEEP

12288:gAjaxsJPuYbIw0JGZUqqLXHHsmfw+fflslYuDZNVKlc:bjaLOILJGfqL3OWflsldDTsi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df7d6129ceb726b6e01762404f768aa2a4bca2366b7e32d93c1a6ef56d4bd5b6

Files

df7d6129ceb726b6e01762404f768aa2a4bca2366b7e32d93c1a6ef56d4bd5b6
.exe windows:5 windows x86 arch:x86

4232c6f19d03345042ed35fd5aec7353

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jeratemoko maro_dowizisonijova40\gegajuli31\pibolu1.pdb

Imports

kernel32

FindVolumeClose
GetNumaProcessorNode
GetConsoleAliasExesLengthA
GetConsoleAliasA
GetCurrentProcess
WriteConsoleInputA
GetNumberFormatA
GetWindowsDirectoryA
GetUserDefaultLangID
GlobalAlloc
GlobalFindAtomA
LoadLibraryW
TerminateThread
GetLocaleInfoW
ReadConsoleInputA
ReadProcessMemory
WriteConsoleW
GetCompressedFileSizeA
SetThreadContext
ChangeTimerQueueTimer
GetThreadLocale
VirtualAlloc
RemoveDirectoryA
CopyFileA
LoadLibraryA
CreateHardLinkW
GetCommMask
AddAtomA
GetModuleFileNameA
GetOEMCP
FindFirstChangeNotificationA
VirtualProtect
SetCalendarInfoA
FindNextVolumeA
SetFileAttributesW
GetVolumeInformationW
CreateFileW
GetLastError
DebugActiveProcess
OutputDebugStringW
FlushFileBuffers
SetStdHandle
ReadFile
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
HeapFree
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetCurrentThreadId
IsDebuggerPresent
GetStdHandle
GetFileType
GetProcessHeap
ExitProcess
GetModuleHandleExW
HeapSize
CloseHandle
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW

user32

GetMenuInfo

gdi32

GetCharacterPlacementA

ole32

CoMarshalHresult

winhttp

WinHttpReadData

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 610KB - Virtual size: 41.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4232c6f19d03345042ed35fd5aec7353

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

ole32

winhttp

Sections

.text Size: 97KB - Virtual size: 97KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: 610KB - Virtual size: 41.5MB

.rsrc Size: 108KB - Virtual size: 107KB

.text
Size: 97KB - Virtual size: 97KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 610KB - Virtual size: 41.5MB

.rsrc
Size: 108KB - Virtual size: 107KB