1a078c4545a861c6f42aa9920d0265ca0d63dd000a6f4251c30419604b7e867d

Sharing

Copy URL Twitter E-mail

General

Target

1a078c4545a861c6f42aa9920d0265ca0d63dd000a6f4251c30419604b7e867d
Size

1.9MB
MD5

541f79ee2c7c41e06f7b72a487f15ecc
SHA1

c56b4e10d9f2e8594b3ef5dabbdf657258cdaee2
SHA256

1a078c4545a861c6f42aa9920d0265ca0d63dd000a6f4251c30419604b7e867d
SHA512

d773db82942dc6e0e7051a4b1c4724fc958ef671f5001927c5066dd19e50d5a55976e919ab91879a8f64ccf7d69ec789e75d64a87a7ee819b1a8c4d2099a3775
SSDEEP

3072:sOnyTGV1tijmRBE9ZOrBdcp6zXybbEcmbnIqHt1UX9I3S+vGIVXKxV+y09uSNTus:sOyK3ESrddcTbFmdpSgzNK+FcS3VT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a078c4545a861c6f42aa9920d0265ca0d63dd000a6f4251c30419604b7e867d

Files

1a078c4545a861c6f42aa9920d0265ca0d63dd000a6f4251c30419604b7e867d
.exe windows:6 windows x86 arch:x86

b435c235420dc9fc090ba038dbbad3b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
FindClose
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
LoadLibraryW
CreateThread
WriteConsoleW
VirtualProtect
GetModuleHandleW
FreeLibrary
GetComputerNameA
CloseHandle
HeapSize
SetFilePointerEx
GetFileSizeEx
GetProcAddress
FindFirstFileW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetFileType
HeapReAlloc
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CreateFileW

user32

GetDesktopWindow
ReleaseDC
CreateWindowExW
DefWindowProcW

advapi32

GetUserNameA

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b435c235420dc9fc090ba038dbbad3b1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 3KB - Virtual size: 6KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 3KB - Virtual size: 6KB

.reloc
Size: 5KB - Virtual size: 5KB