370470933fa395f9e3fb8b2de0364ce918e370a3dbe1d05ebb000a3d31907af4

Sharing

Copy URL Twitter E-mail

General

Target

370470933fa395f9e3fb8b2de0364ce918e370a3dbe1d05ebb000a3d31907af4
Size

152KB
MD5

b67cd52112407afdb177bb6414982ab8
SHA1

2c3071293bd41c001509d36fe9e77d71db4cb274
SHA256

370470933fa395f9e3fb8b2de0364ce918e370a3dbe1d05ebb000a3d31907af4
SHA512

c776a0ac43a0b49aecaa5ef2ee3c173dc2e6824b40c2a4d70318808ea00d52d5bf321f261c33f9f0a1b45378608cb0c0c659e2575e50806f9e249e3b41653546
SSDEEP

3072:RruLVb1ynPR8Jf8LAWkwD1v2Yt4mL9Kivf1TL0cIdlNis/CK/p:FIVE8mLAWx1ukL9KKf1TgcEris/CM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f856e03efe9736f82094b6fe22d52bea2e93cf753ba411a1a7bff7748d355f50.exe

Files

370470933fa395f9e3fb8b2de0364ce918e370a3dbe1d05ebb000a3d31907af4
.zip

Password: infected
f856e03efe9736f82094b6fe22d52bea2e93cf753ba411a1a7bff7748d355f50.exe
.exe windows:5 windows x86 arch:x86

94a130e36ba0209d0710d59b1fb4785b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\waziyafovekeg\88\yexinumefa.pdb

Imports

kernel32

GetTempFileNameW
GetLocaleInfoA
FindResourceW
QueryDosDeviceA
GetUserDefaultLCID
InterlockedCompareExchange
AddConsoleAliasW
GetComputerNameW
GetTickCount
GetConsoleAliasesLengthA
GetConsoleTitleA
EnumResourceTypesA
CreateDirectoryExW
GlobalAlloc
GetSystemDirectoryW
GlobalFindAtomA
LoadLibraryW
AssignProcessToJobObject
GetConsoleAliasExesLengthW
VerifyVersionInfoA
GetLogicalDriveStringsA
SetLastError
GetProcAddress
VirtualAlloc
HeapSize
RemoveDirectoryA
SetComputerNameA
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
GetFileType
GetNumberFormatW
SetFileApisToANSI
VirtualProtect
GetFileAttributesExW
DeleteFileW
GetCurrentProcessId
CreateWaitableTimerA
GetVolumeInformationW
CreateFileA
GetModuleHandleW
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
GetLastError
ReadFile
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
DeleteCriticalSection
HeapFree
SetFilePointer
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
RtlUnwind
HeapAlloc
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
GetConsoleOutputCP
WriteConsoleW

user32

IsWindowEnabled
CharUpperBuffW

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

94a130e36ba0209d0710d59b1fb4785b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 154KB - Virtual size: 154KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 21KB - Virtual size: 73KB

.rsrc Size: 49KB - Virtual size: 49KB

.text
Size: 154KB - Virtual size: 154KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 21KB - Virtual size: 73KB

.rsrc
Size: 49KB - Virtual size: 49KB