815ed7cb70fc647e046bb9045dd63f6859c9ed3313bd10f05d23be3fa6d5b08c

Sharing

Copy URL Twitter E-mail

General

Target

815ed7cb70fc647e046bb9045dd63f6859c9ed3313bd10f05d23be3fa6d5b08c
Size

1.9MB
MD5

78ac939811cf4dd69de5f3b9b8a79fe7
SHA1

3042804dd37e0a97c7df925e6559ae3701d1f987
SHA256

815ed7cb70fc647e046bb9045dd63f6859c9ed3313bd10f05d23be3fa6d5b08c
SHA512

adf655b76f0630c59a8807570c55b671302ade1a3a630532a1d8d822f84edd9306bb6b9ab1e5584820c1d81fa09659445440b3b1c5fe1108d12f0ebac6323973
SSDEEP

3072:JvRIdy9kV1tijgRBE9ZOrBdcp6zXyCbEc5bnILHt1UX9I3S+vGIVXKxV+y09uSNG:JpIkS3EsrddcKbF5ipSgzNK+FcSYVT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
815ed7cb70fc647e046bb9045dd63f6859c9ed3313bd10f05d23be3fa6d5b08c

Files

815ed7cb70fc647e046bb9045dd63f6859c9ed3313bd10f05d23be3fa6d5b08c
.exe windows:6 windows x86 arch:x86

b435c235420dc9fc090ba038dbbad3b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
FindClose
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
LoadLibraryW
CreateThread
WriteConsoleW
VirtualProtect
GetModuleHandleW
FreeLibrary
GetComputerNameA
CloseHandle
HeapSize
SetFilePointerEx
GetFileSizeEx
GetProcAddress
FindFirstFileW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetFileType
HeapReAlloc
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CreateFileW

user32

GetDesktopWindow
ReleaseDC
CreateWindowExW
DefWindowProcW

advapi32

GetUserNameA

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b435c235420dc9fc090ba038dbbad3b1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 3KB - Virtual size: 6KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 3KB - Virtual size: 6KB

.reloc
Size: 5KB - Virtual size: 5KB