81283d1c479e8d73a5aafb2310740f2e31d89d16fd837e5a889804393453d3f9

Sharing

Copy URL

Twitter E-mail

General

Target

81283d1c479e8d73a5aafb2310740f2e31d89d16fd837e5a889804393453d3f9
Size

124KB
MD5

b6a6e1c5ce3928eb79bbe76697db570d
SHA1

b3c96c73cf5fa4d31b58371ed2da54180ab140c0
SHA256

81283d1c479e8d73a5aafb2310740f2e31d89d16fd837e5a889804393453d3f9
SHA512

5afa9b4d4493b463b1927bd006e4a1ebc628bfd55a4eeebd9c3f2b30be86d3ca4e3f90a0838edc510cceb7f9578a24288557f4fc45164849e7977c785be97d2c
SSDEEP

3072:VwA91/6QA/3Lo+EBc6fmrq2lmb37sAzDoY+cT4N:G18P5fm22KnDo1cTO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/f1c19e1cf9f32a5aa6350ced35d355e37ae108dfc208902b72c73874410a5c1b.exe

Files

81283d1c479e8d73a5aafb2310740f2e31d89d16fd837e5a889804393453d3f9
.zip

Password: infected
f1c19e1cf9f32a5aa6350ced35d355e37ae108dfc208902b72c73874410a5c1b.exe
.exe windows:5 windows x86 arch:x86

84afe0ab1b5a409dd53181b32a06f07f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\felo\finuw velevehow meb_didonehe\zenowu_x.pdb

Imports

kernel32

SetVolumeLabelA
SetComputerNameExA
InterlockedIncrement
InterlockedDecrement
CreateJobObjectW
QueryDosDeviceA
SetCommBreak
GetTickCount
EnumResourceTypesA
GetModuleFileNameW
GetLogicalDriveStringsA
GetLastError
SetLastError
GetProcAddress
AttachConsole
VirtualAlloc
LoadLibraryA
WriteConsoleA
LocalAlloc
MoveFileA
RemoveDirectoryW
FindNextChangeNotification
GlobalFindAtomW
FindFirstVolumeMountPointA
GetModuleHandleA
GetConsoleTitleW
GetFileAttributesExW
FatalAppExitA
GetCurrentProcessId
AddConsoleAliasA
DeleteFileA
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
RtlUnwind
HeapAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
HeapSize
CloseHandle
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
RaiseException

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 38.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

84afe0ab1b5a409dd53181b32a06f07f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 10KB - Virtual size: 38.8MB

.rsrc Size: 23KB - Virtual size: 22KB

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 10KB - Virtual size: 38.8MB

.rsrc
Size: 23KB - Virtual size: 22KB