0a54775d17b8be8c1da5386c2195e55ee63d060092180f96afba4789daa28eeb

Sharing

Copy URL Twitter E-mail

General

Target

0a54775d17b8be8c1da5386c2195e55ee63d060092180f96afba4789daa28eeb
Size

237KB
MD5

31803e7436d5a2ffeb0eb5f1450df505
SHA1

3d6d92b6ed355d53f32f1e04b31d057471c00f86
SHA256

0a54775d17b8be8c1da5386c2195e55ee63d060092180f96afba4789daa28eeb
SHA512

46a4cac76a4b0ebea23e81873408eef851abe73e607b30d792c263c116a75cef00ac5566ab354652bef500438800467e7ea3b983b51d3358e497e50ca55d7fd7
SSDEEP

3072:D4YcQfTyVDgp3O2gfK6aUTzJwlk0BNkGzJ0NigdkCME+09/Ogw2YujdEcdZi7V74:M0fTyVkhO2guUZwlXKGKIEtGu9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a54775d17b8be8c1da5386c2195e55ee63d060092180f96afba4789daa28eeb

Files

0a54775d17b8be8c1da5386c2195e55ee63d060092180f96afba4789daa28eeb
.exe windows:5 windows x86 arch:x86

7453252ffd303a4db6c41a69d3ec3618

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalSize
GlobalUnlock
AreFileApisANSI
CopyFileA
WaitForSingleObject
CreateEventA
GetThreadLocale
CreateFileW
ReadFile
GetProcessHeap
SetEndOfFile
WriteConsoleW
HeapReAlloc
FlushFileBuffers
SetStdHandle
GetStringTypeW
CreateFileA
GlobalLock
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
Sleep
CreateDirectoryA
VirtualQuery
CloseHandle
GetFileType
SetHandleCount
LCMapStringW
WideCharToMultiByte
SetLastError
TlsFree
SetErrorMode
LocalFree
FormatMessageA
GetTimeFormatA
lstrcatA
lstrcpyA
GetLocalTime
GetModuleFileNameA
TlsSetValue
TlsGetValue
HeapAlloc
GetProcAddress
LoadLibraryW
SetCurrentDirectoryA
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapCreate
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetCurrentProcess
TerminateProcess
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
LoadLibraryA
UnhandledExceptionFilter
DecodePointer
MultiByteToWideChar
GetSystemDirectoryA
IsProcessorFeaturePresent
GetLastError
GetStartupInfoW
HeapSetInformation
GetCommandLineA
CreateThread
GetCurrentThreadId
ExitThread
RaiseException
DeleteCriticalSection
RtlUnwind

user32

GetDlgItem
BeginPaint
LoadCursorA
EndPaint
SendNotifyMessageW
GetMessageA
DefWindowProcA
ClientToScreen
SendMessageA
DrawIcon
DrawIconEx
LoadImageA
GetWindowLongA
SetWindowsHookExA
GetMenuItemCount
GetMenuItemID
ModifyMenuA
SetWindowTextA
SetWindowPlacement
SetWindowLongA
GetClientRect
GetWindowRect
ShowWindow
SystemParametersInfoA
CreateWindowExA
RegisterClassExA
LoadIconA
FindWindowExA
GetDesktopWindow
EndDialog
WinHelpA
MessageBoxA
GetClipboardData
RegisterClipboardFormatA
EnumDesktopsA
PtInRect
EnableMenuItem
IsClipboardFormatAvailable
DdeCreateStringHandleW
SetWindowPos

gdi32

CreateRectRgn
SetBrushOrgEx
Escape
DeleteObject
Polygon
SelectObject
CreateSolidBrush
GetStockObject

winspool.drv

AddPrinterA

advapi32

ClearEventLogA
GetUserNameA
OpenProcessToken

shell32

Shell_NotifyIconA
DragQueryFileA
SHCreateShellItem

ole32

OleIsCurrentClipboard
OleSetClipboard
CoUnmarshalInterface
OleFlushClipboard
CoUninitialize
CoCreateInstance
OleInitialize
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysFreeString

odbc32

ord41

ws2_32

recv
send

netapi32

NetApiBufferFree
NetWkstaGetInfo

mpr

WNetAddConnection2A

crypt32

CertFindChainInStore

activeds

ord3

pdh

PdhCollectQueryData
PdhBrowseCountersA

secur32

AcquireCredentialsHandleA
FreeCredentialsHandle
QueryContextAttributesA

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

wtsapi32

WTSVirtualChannelPurgeOutput
WTSVirtualChannelOpen
WTSVirtualChannelClose
WTSVirtualChannelPurgeInput
WTSRegisterSessionNotification

rasapi32

RasSetEapUserDataA
RasHangUpA

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 78KB - Virtual size: 717KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7453252ffd303a4db6c41a69d3ec3618

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

odbc32

ws2_32

netapi32

mpr

crypt32

activeds

pdh

secur32

setupapi

wtsapi32

rasapi32

Sections

.text Size: 107KB - Virtual size: 106KB

.text1 Size: 512B - Virtual size: 96B

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 7KB - Virtual size: 16KB

.data1 Size: 512B - Virtual size: 304B

.trace Size: 1KB - Virtual size: 1KB

_RDATA Size: 1KB - Virtual size: 1KB

.rsrc Size: 78KB - Virtual size: 717KB

.text
Size: 107KB - Virtual size: 106KB

.text1
Size: 512B - Virtual size: 96B

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 7KB - Virtual size: 16KB

.data1
Size: 512B - Virtual size: 304B

.trace
Size: 1KB - Virtual size: 1KB

_RDATA
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 78KB - Virtual size: 717KB