1a91a368898eff84850aabfdc0ca57d586bad2990f5fe593096b2fdb0cef4195

Sharing

Copy URL Twitter E-mail

General

Target

1a91a368898eff84850aabfdc0ca57d586bad2990f5fe593096b2fdb0cef4195
Size

1.2MB
MD5

5515de7957086d6889f32e29022855b3
SHA1

296e06481623144908613aa78086d9f76a9f5cef
SHA256

1a91a368898eff84850aabfdc0ca57d586bad2990f5fe593096b2fdb0cef4195
SHA512

7dabf4f6b2ab8d6f31e1ded5b244c776d30ac8a0b4661ee1ffeda793e9560172218bd742b69a4d8fc0105367351c82a340a2d875647c5165da382e6e774387e6
SSDEEP

24576:DUYwUybXy3psEiNfxyyjj5ddddSXJoTNecYdwFZxcnlPHv:DPKu3psEFXJONecYaFZ+lPP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a91a368898eff84850aabfdc0ca57d586bad2990f5fe593096b2fdb0cef4195

Files

1a91a368898eff84850aabfdc0ca57d586bad2990f5fe593096b2fdb0cef4195
.exe windows:6 windows x64 arch:x64

bb7e4794fd4d6f192ceffced81889587

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetTickCount
LoadLibraryW
GetProcAddress
FreeLibrary
CreateDirectoryW
SetLastError
GetCommandLineW
FindNextFileW
GetCurrentProcess
TerminateProcess
FindClose
MultiByteToWideChar
GlobalFlags
GetSystemInfo
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCurrentProcessId
CreateProcessW
WideCharToMultiByte
VirtualQuery
SetEvent
CreateThread
ResetEvent
GetLocalTime
GetSystemTimeAsFileTime
lstrcmpiW
LoadLibraryExW
SetEndOfFile
WriteConsoleW
FlushFileBuffers
FindResourceW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetFileType
GetStdHandle
GetCommandLineA
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
LoadResource
LockResource
FreeResource
InitializeCriticalSection
SizeofResource
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
HeapFree
GlobalAlloc
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
CreateEventW
WriteFile
ReadFile
SetFilePointerEx
CreateFileW
CloseHandle
GetModuleFileNameW
Sleep
ExitProcess
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
RtlCaptureContext
WaitForSingleObjectEx
OutputDebugStringW
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
GetStringTypeW

user32

DefWindowProcW
DestroyWindow
MessageBoxW
GetMessageW
PeekMessageW
ReleaseDC
GetDC
LoadImageW
GetParent
GetDesktopWindow
LoadCursorW
LoadIconW
LoadStringW
GetWindowLongPtrW
SendMessageW
DispatchMessageW
TranslateMessage
CharNextW
MonitorFromWindow
WaitForInputIdle

gdi32

SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject

advapi32

RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegCloseKey

ole32

CreateStreamOnHGlobal
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VarUI4FromStr
SystemTimeToVariantTime

comctl32

ImageList_Destroy
ImageList_Create
ImageList_AddMasked
InitCommonControlsEx

ws2_32

WSACleanup

gdiplus

GdipGetImagePaletteSize
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipAlloc
GdipDisposeImage
GdipGetImagePixelFormat
GdiplusShutdown
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGetImagePalette
GdipSetCompositingMode
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdiplusStartup
GdipFree
GdipDrawImageRectI

Sections

.text
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 882KB - Virtual size: 881KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb7e4794fd4d6f192ceffced81889587

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

ws2_32

gdiplus

Sections

.text Size: 199KB - Virtual size: 198KB

.rdata Size: 76KB - Virtual size: 76KB

.data Size: 5KB - Virtual size: 11KB

.pdata Size: 12KB - Virtual size: 11KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 882KB - Virtual size: 881KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 199KB - Virtual size: 198KB

.rdata
Size: 76KB - Virtual size: 76KB

.data
Size: 5KB - Virtual size: 11KB

.pdata
Size: 12KB - Virtual size: 11KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 882KB - Virtual size: 881KB

.reloc
Size: 3KB - Virtual size: 2KB