9785433fc6ac5bf922f8b4d48149212dc08dca4b255593f8f5e32ed41e194e36

Sharing

Copy URL Twitter E-mail

General

Target

9785433fc6ac5bf922f8b4d48149212dc08dca4b255593f8f5e32ed41e194e36
Size

172KB
MD5

395fa273f83a55ec84be7d26cb91bad7
SHA1

ab9c3d0abc691e411a52523af1a7ae179ee458a7
SHA256

9785433fc6ac5bf922f8b4d48149212dc08dca4b255593f8f5e32ed41e194e36
SHA512

c9fae7ccad42f270d65d65fde6388fa64165286589f93a74888a4fd3675ca23832c862ea9b4d5a87604af357e5636a50ea8b7a996eedb386e375009b3d2c4423
SSDEEP

3072:B6TKyMLF0hLGOKOEywzdtVcMySxdhyWBD83AzahMGyYGwU:6KyjCOKOErdjjbPp8wzCMGbG5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9785433fc6ac5bf922f8b4d48149212dc08dca4b255593f8f5e32ed41e194e36

Files

9785433fc6ac5bf922f8b4d48149212dc08dca4b255593f8f5e32ed41e194e36
.exe windows:4 windows x86 arch:x86

4a6348a43936625a3709f92236fed363

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwClose
ZwCreateFile
RtlInitUnicodeString
_chkstk
_wcsicmp
_wcsnicmp
_alldiv
memcpy
ZwQueryVolumeInformationFile
_allmul
NtLoadDriver
NtUnloadDriver
wcstombs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQueryDirectoryObject
ZwOpenDirectoryObject
vsprintf
strchr
strncpy
wcsstr
_wcslwr
strstr
_wtoi
_wtoi64
memset
sprintf
strrchr

kernel32

InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
InterlockedExchange
LoadLibraryA
GetModuleHandleW
TerminateThread
GetExitCodeProcess
CreatePipe
SetHandleInformation
WideCharToMultiByte
CreateProcessW
OpenFileMappingW
OpenEventW
TerminateProcess
ResetEvent
WaitForSingleObject
SetEvent
UnmapViewOfFile
CloseHandle
CreateEventW
MapViewOfFile
GetLastError
CreateFileMappingW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
DeviceIoControl
CreateFileW
FlushFileBuffers
SetVolumeMountPointW
Sleep
DeleteVolumeMountPointW
GetVolumeNameForVolumeMountPointW
GetSystemWindowsDirectoryW
GetVersionExW
ReadFile
SetFilePointer
GetCurrentProcess
GetFileAttributesW
WriteFile
GlobalMemoryStatusEx
GetLocalTime
GetModuleFileNameA
CreateFileA
CreateDirectoryA
OutputDebugStringA

advapi32

RegOpenKeyW
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
AdjustTokenPrivileges
OpenProcessToken
RegLoadKeyW
RegUnLoadKeyW
RegOpenKeyExW
RegOpenKeyA
RegQueryValueExA
SetSecurityDescriptorDacl

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__CxxFrameHandler3
_vswprintf
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
wcscpy_s
_swprintf
wcsncpy_s
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memmove_s
swprintf_s
printf
_localtime64
_time64
strcpy_s
sprintf_s
_beginthreadex
__dllonexit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
_amsg_exit

msvcp80

?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4a6348a43936625a3709f92236fed363

Headers

File Characteristics

Imports

ntdll

kernel32

advapi32

msvcr80

msvcp80

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 72KB - Virtual size: 72KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 72KB - Virtual size: 72KB