165f3196233914e04709fee2381d6ba50ff7508ebc7ef52a11ee278e414ea6ce

Sharing

Copy URL Twitter E-mail

General

Target

165f3196233914e04709fee2381d6ba50ff7508ebc7ef52a11ee278e414ea6ce
Size

1.2MB
MD5

0cf890d909167be8d2e85bc714310541
SHA1

ce251c1d1764c15c1a1b7cd6d7f3116199d5a834
SHA256

165f3196233914e04709fee2381d6ba50ff7508ebc7ef52a11ee278e414ea6ce
SHA512

74478fcd7eab0cab966b057e8ab5a3e6b7fbbc85d3f644e49cc0ef0b283817de63e098ae5c02af1cd5d5530427aa4808638e7abc41262a393179058b0bdd00f8
SSDEEP

12288:tznOxd9IODwtgbo2FirDV9dB2ughPTCrH4rk/FN+Ac8sIv2fPNLMAYOw9:lnOx/IZ6E2MfVPB2uYE+Z8XYNkOw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
165f3196233914e04709fee2381d6ba50ff7508ebc7ef52a11ee278e414ea6ce

Files

165f3196233914e04709fee2381d6ba50ff7508ebc7ef52a11ee278e414ea6ce
.exe windows:6 windows x64 arch:x64

cdb60d1d31722e1445573189f31e120c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrlenW
GetCurrentThreadId
GetCurrentProcessId
FormatMessageW
LocalFree
GetLastError
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
DecodePointer

user32

CharNextW
CharPrevW

setupapi

CM_Get_Device_ID_ExW
SetupDiClassGuidsFromNameExW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDeviceInfoListExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiCallClassInstaller

msvcr120

_exit
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtSetUnhandledExceptionFilter
?terminate@@YAXXZ
__crtCapturePreviousContext
__crtTerminateProcess
__crtUnhandledException
__iob_func
memset
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
iswalpha
towupper
towlower
wcschr
__crt_debugger_hook
_wcsicmp
_wcsnicmp
fputws
wprintf
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
wcsrchr
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__C_specific_handler
__winitenv
_fmode
_commode

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cdb60d1d31722e1445573189f31e120c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

setupapi

msvcr120

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 480B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 480B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB