1d261a3c4a2b8cf8b514a26a78e71fee050a5da29c66d7597c3200c0e435a441

Sharing

Copy URL

Twitter E-mail

General

Target

1d261a3c4a2b8cf8b514a26a78e71fee050a5da29c66d7597c3200c0e435a441
Size

112KB
MD5

0e17f47720cf9251232914421a6fecab
SHA1

485665f846b0a0d578cf2783be54f38bd40a7271
SHA256

1d261a3c4a2b8cf8b514a26a78e71fee050a5da29c66d7597c3200c0e435a441
SHA512

74d1777ae3c8aed3fd1c5cd674c0f47cb1515a02a16c1971df78ae01f4b6375e0806f7e9f65f09f5429353294ae3b4bdc57128f1a8feebde3b343f5fdab94d98
SSDEEP

1536:+aFdBTgSv09DI2yJcStUetz0jDtaxAV4DEjNjLLE8I6DyO8AYssdN:zXgqNvcStUKzetaxAvLE8IlO8AjqN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d261a3c4a2b8cf8b514a26a78e71fee050a5da29c66d7597c3200c0e435a441

Files

1d261a3c4a2b8cf8b514a26a78e71fee050a5da29c66d7597c3200c0e435a441
.exe windows:4 windows x86 arch:x86

bf362829b0388681a44511cf5e9c8249

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc80

ord4722
ord3403
ord5203
ord4185
ord6275
ord5073
ord1908
ord5152
ord4244
ord1401
ord3946
ord1617
ord1620
ord5912
ord6724
ord1551
ord1670
ord1671
ord2020
ord4580
ord4890
ord4735
ord4212
ord5182
ord1489
ord876
ord2902
ord6118
ord299
ord6703
ord1482
ord1191
ord1187
ord1774
ord1892
ord1123
ord6236
ord3934
ord2322
ord781
ord5403
ord2468
ord304
ord865
ord3641
ord3683
ord4541
ord566
ord3333
ord4261
ord4481
ord2838
ord5566
ord5213
ord5230
ord4568
ord3948
ord2248
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord757
ord587
ord4282
ord907
ord911
ord5710
ord5563
ord2272
ord4085
ord6180
ord6174
ord741
ord715
ord1084
ord1903
ord572
ord3164
ord2991
ord5214
ord4232
ord1402
ord5915
ord6725
ord1545
ord2086
ord3229
ord4237
ord1570
ord2091
ord4099
ord1484
ord1933
ord6266
ord1397
ord1063
ord1794
ord4749
ord709
ord501
ord3406
ord2164
ord629
ord762
ord5089
ord6013
ord3389
ord384
ord6067
ord2168
ord1308
ord2176
ord908
ord6002
ord588
ord328
ord1185
ord2475
ord265
ord266
ord3255
ord1181
ord5320
ord6286
ord5331
ord6297
ord3317
ord4240
ord1591
ord2095
ord3292
ord1581
ord1643
ord3761
ord850
ord1873
ord2657
ord1600
ord5960
ord5235
ord5233
ord923
ord928
ord932
ord930
ord934
ord2390
ord2410
ord2394
ord2400
ord2398
ord2396
ord2413
ord2408
ord2392
ord2415
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord5175
ord1964
ord1656
ord1655
ord1599
ord5200
ord2537
ord2731
ord2835
ord4307
ord2714
ord2862
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4486
ord4262
ord3182
ord354
ord310
ord784
ord605
ord578
ord657
ord764
ord1207

msvcr80

_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
memcmp
memmove
srand
rand
memmove_s
memcpy_s
free
_controlfp_s
printf
__CxxFrameHandler3
_mktime64
sprintf
_setmbcp
strlen
memset
_time64
atol
toupper
memcpy
_strnicmp
strncpy
malloc

kernel32

GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
InterlockedExchange
GetLastError
GetTickCount
SetEndOfFile
ReadFile
SetFilePointer
GetFileSize
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
GetSystemDirectoryA
CopyFileA
CreateFileA
CloseHandle
GetModuleFileNameA
WritePrivateProfileStringA
GetTempPathA
lstrlenA
WriteFile
GetFileTime
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SetFileTime

user32

GetSystemMetrics
CharLowerBuffA
EnableWindow
DrawIcon
SetTimer
UpdateWindow
LoadIconA
GetClientRect
IsIconic
SendMessageA

advapi32

RegQueryInfoKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

CoCreateGuid

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ZCOLL_TE
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf362829b0388681a44511cf5e9c8249

Headers

File Characteristics

Imports

mfc80

msvcr80

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 64KB - Virtual size: 62KB

ZCOLL_TE Size: 4KB - Virtual size: 1KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 16KB - Virtual size: 13KB

.text
Size: 64KB - Virtual size: 62KB

ZCOLL_TE
Size: 4KB - Virtual size: 1KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 16KB - Virtual size: 13KB