8c0d7971bd4527da3aba34a9be7cbe48e717b2d5451df89bdbd5a0b094d9b82e

Sharing

Copy URL Twitter E-mail

General

Target

8c0d7971bd4527da3aba34a9be7cbe48e717b2d5451df89bdbd5a0b094d9b82e
Size

327KB
MD5

29bba81db9044f203e409c5f1d57c7c9
SHA1

c0b9c24b494b04726873ad398a250ef8f66249fa
SHA256

8c0d7971bd4527da3aba34a9be7cbe48e717b2d5451df89bdbd5a0b094d9b82e
SHA512

0d21654df01e228c993eef7fefe5a595360e86541305625e0f16a471f72675de432ebedac3fe9875ea402498115a3cdaf3e8974dc991a55737dd8bda07fd94a2
SSDEEP

6144:pFpbfhXMQE8P8fN1l3vWyOK+aIQwxVavLVRP90e:pFpbfKd3vJ+aHwW530e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c0d7971bd4527da3aba34a9be7cbe48e717b2d5451df89bdbd5a0b094d9b82e

Files

8c0d7971bd4527da3aba34a9be7cbe48e717b2d5451df89bdbd5a0b094d9b82e
.exe windows:5 windows x86 arch:x86

06795e7a4243010ba1cddcdd6acb03bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToTzSpecificLocalTime
HeapAlloc
SystemTimeToFileTime
CreateDirectoryW
SetEvent
FreeEnvironmentStringsA
GetTickCount
GetConsoleAliasesA
GetConsoleAliasesLengthA
LoadLibraryW
AssignProcessToJobObject
ReplaceFileW
FlushFileBuffers
GetCurrentDirectoryW
WriteConsoleOutputCharacterA
lstrcmpiA
GetProcAddress
CreateNamedPipeA
LoadLibraryA
LocalAlloc
SetProcessWorkingSetSize
AddAtomA
EnumDateFormatsA
EraseTape
VirtualProtect
CompareStringA
FatalAppExitA
IsValidLocale
EnumSystemLocalesA
SetLastError
GetComputerNameA
GetLocaleInfoA
GetUserDefaultLCID
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
HeapReAlloc
IsProcessorFeaturePresent
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointer
CloseHandle
WriteConsoleW
SetStdHandle
CreateFileW
RaiseException

user32

GetClassLongW

advapi32

AccessCheckByType

ole32

CreateDataCache

Sections

.text
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 39.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kekazar
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06795e7a4243010ba1cddcdd6acb03bf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

Sections

.text Size: 197KB - Virtual size: 196KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 11KB - Virtual size: 39.7MB

.kekazar Size: 1024B - Virtual size: 1024B

.rsrc Size: 104KB - Virtual size: 103KB

.text
Size: 197KB - Virtual size: 196KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 11KB - Virtual size: 39.7MB

.kekazar
Size: 1024B - Virtual size: 1024B

.rsrc
Size: 104KB - Virtual size: 103KB