6c81557407b1e9a25cd8885b49ee726475470077b0b97c28ec79d00697de088f

Sharing

Copy URL

Twitter E-mail

General

Target

6c81557407b1e9a25cd8885b49ee726475470077b0b97c28ec79d00697de088f
Size

75KB
MD5

9846d8b0e749c53f669b2cd3c6103db9
SHA1

dd9eb57aa3b25ce46d1acea11dbbdab2fe55700c
SHA256

6c81557407b1e9a25cd8885b49ee726475470077b0b97c28ec79d00697de088f
SHA512

1efc1470d15dc34136221d011b9381aefbd3f2b46cc240c3d859ffb951adaec53102df1011d35279d17dbb608833ee154a5d3026040b036993543e5f629a0a1f
SSDEEP

1536:AGvvF9JsQ6ZsM01g5iSwRJWEyq4DSruYtM4sOgCRloJR/0JoFl7sY1+:7FD9e1inWE/4D+XllZJ2l7L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
6c81557407b1e9a25cd8885b49ee726475470077b0b97c28ec79d00697de088f

Files

6c81557407b1e9a25cd8885b49ee726475470077b0b97c28ec79d00697de088f
.exe windows:4 windows x86 arch:x86

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CloseHandle
GetCurrentProcessId
FlushInstructionCache
SetLastError
lstrcmpA
FreeLibrary
IsBadReadPtr
GetVersionExA
GetSystemDirectoryA
ExitProcess
WaitForSingleObjectEx
SetEvent
OpenEventA
InterlockedIncrement
WaitForSingleObject
ExitThread
Sleep
DeleteFileA
UnmapViewOfFile
lstrcatA
OutputDebugStringA
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
GetTickCount
WriteProcessMemory
VirtualFree
VirtualAlloc
MapViewOfFileEx
CreateFileMappingA
SetThreadContext
VirtualProtectEx
GetThreadContext
CreateRemoteThread
ResumeThread
DuplicateHandle
EnterCriticalSection
CreateProcessA
FindNextFileA
FindFirstFileA
GetExitCodeThread
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAllocEx
VirtualFreeEx
QueryDosDeviceA
GetLogicalDriveStringsA
CreateThread
GetWindowsDirectoryA
CopyFileA
GetFileAttributesA
CreateEventA
CreateFileA
MapViewOfFile
SetFileTime
GetFileTime
RemoveDirectoryA
WideCharToMultiByte
MultiByteToWideChar
ResetEvent
OpenFile
GlobalAlloc
GlobalFree
LeaveCriticalSection
GetCurrentProcess
InitializeCriticalSection
lstrcpynA
HeapAlloc
lstrlenA
HeapReAlloc
GetLastError
lstrcpyA
HeapFree
GetProcessHeap
lstrcmpiA
VirtualQuery
VirtualProtect
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
OpenProcess
LoadLibraryA

user32

wvsprintfA
MessageBoxA
wsprintfA

advapi32

SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegQueryInfoKeyA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
InitializeSecurityDescriptor
RegCreateKeyExA
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

oleaut32

VariantInit
SysAllocString
SysFreeString

wininet

HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCanonicalizeUrlA
InternetOpenA
InternetSetOptionA
InternetQueryDataAvailable
InternetCrackUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetQueryOptionA
HttpAddRequestHeadersA

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ws2_32

WSAGetLastError
select
inet_ntoa
accept
listen
closesocket
bind
setsockopt
htonl
htons
socket
getpeername
WSAStartup
WSACleanup
inet_addr
gethostbyname
recv
send
connect
shutdown
ioctlsocket
ntohl

urlmon

ObtainUserAgentString

Exports

Exports

?unzip@@YAPAXPADPAK@Z
InstallHook
_WorkProc@4
__mp@4

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

wininet

rpcrt4

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 66KB

.reloc Size: 7KB - Virtual size: 8KB

.text
Size: 66KB - Virtual size: 66KB

.reloc
Size: 7KB - Virtual size: 8KB