171b820f4f6ae96e9975d4fbd7fc2ebcaba4c221b52f886621fba8c395a07543

Sharing

Copy URL Twitter E-mail

General

Target

171b820f4f6ae96e9975d4fbd7fc2ebcaba4c221b52f886621fba8c395a07543
Size

194KB
MD5

a4292876a767fa1c4aa168ea8c9e00ad
SHA1

ce9757cc6139c1e84aa07194f6c44396d5f95c53
SHA256

171b820f4f6ae96e9975d4fbd7fc2ebcaba4c221b52f886621fba8c395a07543
SHA512

570f2bf9c471e53bb7a3c65e4031bfaf6e7c5107567384d04f603c96f9338b5e3644513c06a9f38e63dcf5edccf1e44d88c1916d5ae39698f86141759f547605
SSDEEP

3072:X4rkJRpywFp+U5S+OQV0goOCIfCFcg5LJjVqH+I34M96htkgWnyEJonRMII4JF:JJRpFFp+U5SK6grf0cgnVMCk9FkcSF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/65e6e068eb8714b0538e71485a1cf8f2c362e5669328c5222278d13b820e0914.exe

Files

171b820f4f6ae96e9975d4fbd7fc2ebcaba4c221b52f886621fba8c395a07543
.zip

Password: infected
65e6e068eb8714b0538e71485a1cf8f2c362e5669328c5222278d13b820e0914.exe
.exe windows:5 windows x86 arch:x86

37a554737fc76f8b4939157992b97bd7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
IsBadHugeReadPtr
GetCommState
HeapFree
GetComputerNameW
LockFile
ConnectNamedPipe
GetModuleHandleW
GetDateFormatA
GetUserDefaultLangID
GetCurrencyFormatW
GetConsoleCP
GlobalAlloc
VirtualFreeEx
LoadLibraryW
GetConsoleAliasesLengthW
GetVersionExW
GetAtomNameW
SetConsoleTitleA
GetShortPathNameA
SetCurrentDirectoryA
GetCurrentDirectoryW
GetProcAddress
LoadLibraryA
HeapLock
GetModuleFileNameA
FreeEnvironmentStringsW
DeleteCriticalSection
SetCalendarInfoA
SetStdHandle
SetFilePointer
SetDefaultCommConfigA
GetConsoleAliasExesLengthW
HeapReAlloc
HeapAlloc
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsProcessorFeaturePresent
GetConsoleMode
FlushFileBuffers
LCMapStringW
GetStringTypeW
ReadFile
CloseHandle
WriteConsoleW
CreateFileW

user32

LoadIconA

advapi32

OpenThreadToken
RegCreateKeyA

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 259KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 39.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

37a554737fc76f8b4939157992b97bd7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 32KB - Virtual size: 32KB

.rdata Size: 259KB - Virtual size: 258KB

.data Size: 7KB - Virtual size: 39.2MB

.tls Size: 2KB - Virtual size: 2KB

.rsrc Size: 62KB - Virtual size: 62KB

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 259KB - Virtual size: 258KB

.data
Size: 7KB - Virtual size: 39.2MB

.tls
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 62KB - Virtual size: 62KB