ed5b4dc21400466a32f14a48a9dff112f123c4147009493677f74d078887de9d

Sharing

Copy URL Twitter E-mail

General

Target

ed5b4dc21400466a32f14a48a9dff112f123c4147009493677f74d078887de9d
Size

2.3MB
MD5

9875bbe3a0e25ebb2381d6d7d7f01c1c
SHA1

d0006366da577cd61fe5d690c2e18c9d35510e2c
SHA256

ed5b4dc21400466a32f14a48a9dff112f123c4147009493677f74d078887de9d
SHA512

b82c2d816dbd9e1d56a1e54c9b3b56e053186b5986f04e0b7ae0a8c751d08a2333a117406a6236b641c11988e2565d2123a3ca5565a46798d282cc59d58845fe
SSDEEP

49152:XrRcGgxhbkNVR1JP/S3odmCxmx/YC947Y:X9gbkT3JP/SYJI/j947Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed5b4dc21400466a32f14a48a9dff112f123c4147009493677f74d078887de9d

Files

ed5b4dc21400466a32f14a48a9dff112f123c4147009493677f74d078887de9d
.dll windows:5 windows x86 arch:x86

02c07512a523784dee15cfed18f488ac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

powrprof

ReadGlobalPwrPolicy

advapi32

CryptSetProviderExW
ImpersonateSelf

user32

SetScrollInfo
LookupIconIdFromDirectory
GetMessageA

ws2_32

WSAGetLastError

gdi32

StartPage

kernel32

LoadLibraryExA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetCurrentConsoleFont
DeleteCriticalSection
OutputDebugStringA
GetThreadLocale
GetBinaryTypeW
GetConsoleScreenBufferInfo
GetSystemPowerStatus
GetCurrentProcessId
GetModuleFileNameW
RtlUnwind

ole32

CoGetMalloc

Sections

.text
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: 388KB - Virtual size: 391KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lq8zSJD
Size: 900KB - Virtual size: 898KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

h
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

u+SHmg8
Size: 520KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nmT
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02c07512a523784dee15cfed18f488ac

Headers

File Characteristics

Imports

powrprof

advapi32

user32

ws2_32

gdi32

kernel32

ole32

Sections

.text Size: 124KB - Virtual size: 122KB

.rdata Size: 4KB - Virtual size: 2KB

.code Size: 388KB - Virtual size: 391KB

lq8zSJD Size: 900KB - Virtual size: 898KB

h Size: 108KB - Virtual size: 105KB

u+SHmg8 Size: 520KB - Virtual size: 519KB

DATA Size: 104KB - Virtual size: 100KB

nmT Size: 56KB - Virtual size: 53KB

.CRT Size: 4KB - Virtual size: 4B

.rsrc Size: 40KB - Virtual size: 38KB

DATA Size: 80KB - Virtual size: 78KB

.text
Size: 124KB - Virtual size: 122KB

.rdata
Size: 4KB - Virtual size: 2KB

.code
Size: 388KB - Virtual size: 391KB

lq8zSJD
Size: 900KB - Virtual size: 898KB

h
Size: 108KB - Virtual size: 105KB

u+SHmg8
Size: 520KB - Virtual size: 519KB

DATA
Size: 104KB - Virtual size: 100KB

nmT
Size: 56KB - Virtual size: 53KB

.CRT
Size: 4KB - Virtual size: 4B

.rsrc
Size: 40KB - Virtual size: 38KB

DATA
Size: 80KB - Virtual size: 78KB