4f0e15a4f771f384cc7991d6d24df609d9650565ae79809320d2ec453b98fc10

Sharing

Copy URL Twitter E-mail

General

Target

4f0e15a4f771f384cc7991d6d24df609d9650565ae79809320d2ec453b98fc10
Size

2.7MB
MD5

3bcc79c1bfa4bf172d3d3863277e5c48
SHA1

3f1b2aa655a704a4e7d7486b96ff22a41dcbc797
SHA256

4f0e15a4f771f384cc7991d6d24df609d9650565ae79809320d2ec453b98fc10
SHA512

febdd0a0a48ca53883be98e1e7c7f28337ef008669adfebff8e11ee07de8856716556902c2aab967d324b1a2cd56a070263e8cbaf8dfd2977d80956973c05c2f
SSDEEP

24576:1nf5dbJ60h7EMcfNJHPApPTJw4WJtx33C9FuTKXeCGd/FYvxjFnli:lBdbvh7Hc1WwhJ8oWu5FYZj9li

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f0e15a4f771f384cc7991d6d24df609d9650565ae79809320d2ec453b98fc10

Files

4f0e15a4f771f384cc7991d6d24df609d9650565ae79809320d2ec453b98fc10
.exe windows:4 windows x86 arch:x86

e1b68993c8f8d9e8990d379b7ee96622

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit

mpr

WNetCloseEnum

comctl32

InitializeFlatSB

version

VerLanguageNameA
VerQueryValueW
VerLanguageNameW
VerQueryValueA

kernel32

Module32NextW
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
LeaveCriticalSection
ExitProcess
EnterCriticalSection
InitializeCriticalSection
GetCommandLineA
IsValidCodePage
CloseHandle
CompareStringA
CompareStringW
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnumSystemLocalesA
ExitThread
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
FindResourceExW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FormatMessageA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeResource
GetACP
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetDiskFreeSpaceExW
GetDriveTypeA
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLocalTime
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileIntW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetThreadLocale
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsProcessorFeaturePresent
IsValidLocale
LCMapStringA
LCMapStringW
LoadLibraryW
LoadResource
LocalFree
LockResource
lstrlenA
lstrlenW
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenEventW
OpenProcess
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
SleepEx
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW

user32

ShowWindow
SystemParametersInfoW
TranslateMessage
UnregisterClassA
SetWindowPos
SetWindowLongW
SetTimer
SetRectEmpty
SetRect
SetForegroundWindow
SetCursor
PtInRect
SetCapture
SetActiveWindow
SendMessageW
ScreenToClient
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClassExW

winspool.drv

SetPortW
SetPortA
XcvDataW
WaitForPrinterChange
SetPrinterDataExW
SetPrinterDataExA
SetPrinterDataW
StartPagePrinter
StartDocPrinterW
StartDocPrinterA
SetPrinterW
SetPrinterA
SetJobW
WritePrinter

advapi32

StartServiceW
StartServiceCtrlDispatcherW
StartServiceCtrlDispatcherA
StartServiceA
SetTokenInformation
SetThreadToken
SetServiceStatus
SetServiceObjectSecurity
SetSecurityDescriptorSacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
CloseServiceHandle

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cxm66
Size: 999KB - Virtual size: 999KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e1b68993c8f8d9e8990d379b7ee96622

Headers

File Characteristics

Imports

msvcrt

mpr

comctl32

version

kernel32

user32

winspool.drv

advapi32

Sections

.text Size: 412KB - Virtual size: 411KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 14.0MB

.tls Size: 4KB - Virtual size: 16B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.cxm66 Size: 999KB - Virtual size: 999KB

.text
Size: 412KB - Virtual size: 411KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 14.0MB

.tls
Size: 4KB - Virtual size: 16B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.cxm66
Size: 999KB - Virtual size: 999KB