0dcda110d2810390ee35bbcab5b40d9b8598c47c304be2a42fd9bbb42b0dbd48

Sharing

Copy URL Twitter E-mail

General

Target

0dcda110d2810390ee35bbcab5b40d9b8598c47c304be2a42fd9bbb42b0dbd48
Size

1.3MB
MD5

0d7a5f626a7c150b5d3af04f3ac020b9
SHA1

f29ec5682349768d12b758c194c2ac784ef8a88d
SHA256

0dcda110d2810390ee35bbcab5b40d9b8598c47c304be2a42fd9bbb42b0dbd48
SHA512

65941b78ef325ccf80aa7f119e4f656fa21cb6e29bb8f113b8be978e200b17b536e8122e5e402bfebdad73cd6c5dd42567ee8e11a7db75baabee5ab26ba4a411
SSDEEP

24576:EQv8nEjR/s/DZJMLi0ati4wY36Q3IPQ6IelUzO3hlCjzo2q5CUy0JjFs8d:HvYENELZoiF336G5OUzKhlV/7vJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dcda110d2810390ee35bbcab5b40d9b8598c47c304be2a42fd9bbb42b0dbd48

Files

0dcda110d2810390ee35bbcab5b40d9b8598c47c304be2a42fd9bbb42b0dbd48
.exe windows:4 windows x86 arch:x86

af52b9663bfbdb3e1060ac9ec1e50adb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
OpenProcess
CreateThread
Sleep
GlobalMemoryStatusEx
GetProcessHeap
HeapAlloc
GlobalSize
CreateFileA
DeviceIoControl
VirtualAlloc
VirtualFree
GetCurrentProcessId
GetEnvironmentVariableA
CreateProcessA
CloseHandle
VirtualAllocEx
CreateRemoteThread
GetExitCodeThread
VirtualFreeEx
CreateEventA
LocalFree
GetModuleHandleA
GetProcAddress
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
ReadFile
GetFileSize
WriteFile
WaitForSingleObject
GetStartupInfoA
GetTickCount
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
OpenEventA
TerminateProcess
CreateFileMappingA
OpenFileMappingA
LocalAlloc
CreateMutexA

user32

GetWindowTextA
IsWindowVisible
GetWindowThreadProcessId
GetClassNameA
WaitForInputIdle
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA

advapi32

GetTokenInformation
OpenProcessToken

ws2_32

ioctlsocket
connect
select
closesocket
WSAStartup
send
setsockopt
getsockname
ntohs
WSAAsyncSelect
gethostbyname
WSACleanup
inet_addr
recv
socket
htons

psapi

EnumProcesses

shell32

ShellExecuteA

msvcrt

strstr
malloc
realloc
free
strchr
strrchr
rand
srand
_CIpow
_CIfmod
strtod
floor
??2@YAPAXI@Z
sprintf
atoi
_ftol
??3@YAXPAX@Z

shlwapi

PathFileExistsA

oleaut32

VariantTimeToSystemTime

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RxfbBT0
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af52b9663bfbdb3e1060ac9ec1e50adb

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

psapi

shell32

msvcrt

shlwapi

oleaut32

Sections

.text Size: 152KB - Virtual size: 152KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 19KB - Virtual size: 80KB

RxfbBT0 Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 1024B - Virtual size: 648B

.text
Size: 152KB - Virtual size: 152KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 19KB - Virtual size: 80KB

RxfbBT0
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 1024B - Virtual size: 648B