827e1516f1431818cb62ade5968f08772dbf8f0fc0db7fc37539610a221add33

Sharing

Copy URL Twitter E-mail

General

Target

827e1516f1431818cb62ade5968f08772dbf8f0fc0db7fc37539610a221add33
Size

52KB
MD5

c22b8f3d44d3c1fb003d5bbeee001980
SHA1

9645790afa418a50006940a407f332733f998020
SHA256

827e1516f1431818cb62ade5968f08772dbf8f0fc0db7fc37539610a221add33
SHA512

36a0c932c20a46aa14d4cf21e18c43c89d486884f28b27d673124919f21e7401b2ebe03449b969c7a28523ed1fe2b48701d55ce0eb87a3b187de0986b3e807b7
SSDEEP

768:ZjQn/FRr4+xu33pRAmQTlAF+i756cvlO:untRr+5q1pMocvlO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
827e1516f1431818cb62ade5968f08772dbf8f0fc0db7fc37539610a221add33

Files

827e1516f1431818cb62ade5968f08772dbf8f0fc0db7fc37539610a221add33
.exe windows:4 windows x86 arch:x86

f690849beeb36157d49229f8d6a809cf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
ReadFile
GetFileSize
CreateFileA
WriteFile
SetFileAttributesA
GetCurrentProcess
WideCharToMultiByte
CreateMutexA
CompareStringA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
HeapReAlloc
VirtualAlloc
HeapAlloc
GetOEMCP
GetACP
GetCPInfo
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
GetVersion
GetStartupInfoA
RtlUnwind
LocalAlloc
GetSystemDirectoryA
GetModuleHandleA
IsBadStringPtrA
GetLocalTime
lstrcmpiA
GetVersionExA
GlobalMemoryStatus
GetComputerNameA
GetStringTypeW
GetLastError
GetCurrentThreadId
GetShortPathNameA
LoadLibraryA
FreeLibrary
GetProcAddress
lstrcpyA
GetTempPathA
GetWindowsDirectoryA
lstrcatA
GetFileAttributesA
DeleteFileA
LocalFree
lstrlenA
IsBadReadPtr
IsBadWritePtr
CreateThread
lstrcpynA
GetCommandLineA
WaitForSingleObject
GetTickCount
Sleep
GetModuleFileNameA
ExitProcess

user32

CloseDesktop
wvsprintfA
PeekMessageA
DispatchMessageA
TranslateMessage
wsprintfA
GetUserObjectInformationA
OpenInputDesktop

advapi32

CreateServiceA
RegOpenKeyA
RegCreateKeyA
RegSetValueExA
RegDeleteValueA
RegQueryValueExA
RegCloseKey
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
SetServiceStatus
ControlService
DeleteService
GetUserNameA
CloseServiceHandle
StartServiceA
OpenServiceA
OpenSCManagerA

shell32

ShellExecuteA

ws2_32

getpeername
ntohs
send
recv
WSAGetLastError
inet_addr
gethostbyaddr
gethostbyname
htons
connect
inet_ntoa
WSACreateEvent
socket
WSACloseEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSACleanup
WSAStartup
closesocket

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f690849beeb36157d49229f8d6a809cf

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB