44bf265d5da89567c64b749db5d10627abc76605e622169c01a495dfea59a34f

Sharing

Copy URL Twitter E-mail

General

Target

44bf265d5da89567c64b749db5d10627abc76605e622169c01a495dfea59a34f
Size

1.4MB
MD5

bb2ca4f8eb95053dd450d58b335919c1
SHA1

e36d39b383f010bb2acbc10fd97ffcd487c91c29
SHA256

44bf265d5da89567c64b749db5d10627abc76605e622169c01a495dfea59a34f
SHA512

f1eec5ed806be47e4ad4f9b06a932e38c97aef00411f6c5a4af7049849019634587995ec9c099d1cf3454328107448e24ac589dc65a0f39ac2ac9756c934ab1b
SSDEEP

24576:mht8Ja1LHHnoya/ZVaXEww2W8p6/IMUfSmUitrtfiZf2St:mh+JInoJFn2WUcI3dJi9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44bf265d5da89567c64b749db5d10627abc76605e622169c01a495dfea59a34f

Files

44bf265d5da89567c64b749db5d10627abc76605e622169c01a495dfea59a34f
.exe windows:6 windows x64 arch:x64

f6c4d1baaba882753da8a7e643801ce2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetDiskFreeSpaceExW
CloseHandle
GetLogicalDriveStringsA
LocalAlloc
FormatMessageW
LocalFree
GetTempPathW
DeleteFileW
CreateProcessA
FreeResource
CreateFileW
WriteFile
GetModuleFileNameA
lstrcmpW
WideCharToMultiByte
CopyFileW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindResourceW
LoadResource
FindResourceExW
HeapReAlloc
LockResource
GetLastError
Sleep
MultiByteToWideChar
SetFileAttributesW
HeapSize
FindClose
InitializeCriticalSectionEx
FindNextFileW
HeapFree
FindFirstFileW
SizeofResource
CreateDirectoryW
GetTimeZoneInformation
GetStringTypeW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetTickCount
SetLastError
MoveFileExA
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
RtlUnwindEx
RtlPcToFileHeader
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDriveTypeW
GetFullPathNameW
SetEnvironmentVariableW
GetCurrentDirectoryW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
RtlUnwind

advapi32

CryptEncrypt
CryptDestroyKey
GetUserNameW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptImportKey

shell32

ShellExecuteW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitialize

oleaut32

VariantInit
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear

wtsapi32

WTSEnumerateProcessesW

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertOpenStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptStringToBinaryA
CertGetCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore

wininet

InternetCheckConnectionW

ws2_32

htons
gethostname
ioctlsocket
sendto
recvfrom
freeaddrinfo
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getaddrinfo
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
recv
bind
connect
getpeername
getsockname
getsockopt
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
inet_pton
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen

Sections

.text
Size: 667KB - Virtual size: 667KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 546KB - Virtual size: 545KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6c4d1baaba882753da8a7e643801ce2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

wtsapi32

crypt32

wininet

ws2_32

Sections

.text Size: 667KB - Virtual size: 667KB

.rdata Size: 185KB - Virtual size: 184KB

.data Size: 6KB - Virtual size: 13KB

.pdata Size: 29KB - Virtual size: 29KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 546KB - Virtual size: 545KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 667KB - Virtual size: 667KB

.rdata
Size: 185KB - Virtual size: 184KB

.data
Size: 6KB - Virtual size: 13KB

.pdata
Size: 29KB - Virtual size: 29KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 546KB - Virtual size: 545KB

.reloc
Size: 4KB - Virtual size: 4KB