06f5ea3795219c4ecb54110673db39160f3621b2be4d6a669a9354be398145ab

Sharing

Copy URL Twitter E-mail

General

Target

06f5ea3795219c4ecb54110673db39160f3621b2be4d6a669a9354be398145ab
Size

667KB
MD5

13e08086f0bcdc619e20b88f16e27006
SHA1

165762567887f3b7cb1eb6b95f40ca953b373c87
SHA256

06f5ea3795219c4ecb54110673db39160f3621b2be4d6a669a9354be398145ab
SHA512

ae7410b5bfe696321d4ad1c78339f7c3708586ebe6ad3d04f47b3dc994b471c32fee4fdf22f15221b007c7f769e86e435e9e9799416a65b395a311cf344b7166
SSDEEP

12288:7+aDj5AW3QMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:7Tb35SkQ/7Gb8NLEbeZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06f5ea3795219c4ecb54110673db39160f3621b2be4d6a669a9354be398145ab

Files

06f5ea3795219c4ecb54110673db39160f3621b2be4d6a669a9354be398145ab
.exe windows:10 windows x86 arch:x86

f7758c78c7848b809e98fab3c95d1c39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

midl.pdb

Imports

kernel32

GetCommandLineW
GetStdHandle
GetEnvironmentVariableW
WaitForSingleObject
MultiByteToWideChar
CloseHandle
LocalFree
CreateProcessW
CreateProcessA
GetExitCodeProcess
GetModuleHandleA
Sleep
GetTempPathA
GetLastError
GetProcAddress
GetTempFileNameA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
RtlUnwind
OutputDebugStringA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

msvcrt

fflush
_unlink
printf
fopen
fclose
fgetc
isspace
_errno
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
strstr
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
wcsstr
memcpy
memset
?terminate@@YAXXZ
_controlfp
_lock
_unlock
__dllonexit
_onexit
setvbuf
isxdigit
isleadbyte
calloc
free
localeconv
mbtowc
__mb_cur_max
_iob
_snprintf
_itoa
wctomb
malloc
_read
__badioinfo
__pioinfo
realloc
_write
_lseeki64
_strnicmp
atoi
ctime
_makepath
strncmp
_fileno
fprintf
_isatty
_splitpath
fseek
_vsnprintf
_fgetchar
freopen
isdigit
__set_app_type
__iob_func
putc
_fsopen
_setmode
fwrite
??1type_info@@UAE@XZ

shell32

CommandLineToArgvW

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f7758c78c7848b809e98fab3c95d1c39

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

shell32

Sections

.text Size: 92KB - Virtual size: 91KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 92KB - Virtual size: 91KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 568KB - Virtual size: 572KB