309400bcb4b991cd3ef54c60975dcc724c6d56ad22364dab4609b6cbf8f063ea

Sharing

Copy URL Twitter E-mail

General

Target

309400bcb4b991cd3ef54c60975dcc724c6d56ad22364dab4609b6cbf8f063ea
Size

9.1MB
MD5

8a52418f075d48bf8ac973617497cd80
SHA1

cab2e3cc529b082c239a8b7f8505bc9404277d3b
SHA256

309400bcb4b991cd3ef54c60975dcc724c6d56ad22364dab4609b6cbf8f063ea
SHA512

33dbd019db906173215387771fdcef18b5458e9d677ce2dc93df11d2d9c2728869a6bbcb8a263ef64e9bb13cc1077348ec42b7522e472729ceeb9847f2eca0f4
SSDEEP

98304:biCCzNT0MuOHkWn0f+6QpREZVuWfHpz2sR1IiXfI2B+:Z60EHkWn0fDsGVnPNLRTIW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
309400bcb4b991cd3ef54c60975dcc724c6d56ad22364dab4609b6cbf8f063ea

Files

309400bcb4b991cd3ef54c60975dcc724c6d56ad22364dab4609b6cbf8f063ea
.exe windows:4 windows x64 arch:x64

40268a789e0b5a57afcbe54518e7bd64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateThread
CreateEventA
lstrlenW
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
lstrcmpiA
LeaveCriticalSection
EnterCriticalSection
Sleep
GetCurrentThreadId
GetCommandLineA
FreeLibrary
GetSystemDirectoryA
GetSystemWow64DirectoryA
GetProcAddress
LoadLibraryExA
LoadLibraryA
GetStringTypeW
SetEvent
LCMapStringW
LCMapStringA
GetCPInfo
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
GetLastError
WideCharToMultiByte
__C_specific_handler
VirtualQuery
GetSystemInfo
GetOEMCP
GetACP
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
GetLocaleInfoA
SetUnhandledExceptionFilter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
ExitProcess
VirtualAlloc
VirtualProtect
GetVersionExA
WaitForSingleObject
GetStringTypeA
CloseHandle
HeapAlloc
HeapFree
RtlLookupFunctionEntry
RtlUnwindEx
GetProcessHeap
GetStartupInfoA
RaiseException
RtlPcToFileHeader
HeapSetInformation
HeapCreate

user32

PostThreadMessageA
GetMessageA
DispatchMessageA
CharUpperA
CharNextA
LoadStringA

advapi32

RegConnectRegistryA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumKeyExA

shell32

SHGetSpecialFolderPathA

ole32

StringFromCLSID
CreateItemMoniker
CoInitialize
CoUninitialize
CoTaskMemFree
GetRunningObjectTable

oleaut32

SysFreeString
LoadRegTypeLi
SysStringLen
SysAllocStringLen
SysAllocString

rpcrt4

UuidFromStringA

atl

ord21
ord58
ord32
ord16
ord30

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vyigban
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

40268a789e0b5a57afcbe54518e7bd64

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

rpcrt4

atl

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 28KB - Virtual size: 29KB

vyigban Size: - Virtual size: 4KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 28KB - Virtual size: 29KB

vyigban
Size: - Virtual size: 4KB