992597951b73ff1193cbcdee202aaf6758838d6a6b5e4b14d35c9a5d339b8705

General

Target

992597951b73ff1193cbcdee202aaf6758838d6a6b5e4b14d35c9a5d339b8705
Size

8.0MB
MD5

e3d1633fb6d3203f010908612212c22c
SHA1

5de2daf278db3f94273671ffacbe584fdc73e8ee
SHA256

992597951b73ff1193cbcdee202aaf6758838d6a6b5e4b14d35c9a5d339b8705
SHA512

c026a8bb757dd64b05a4769a5b8ec35f9d3bf9197abc3544cdf1736f207e8cee20c154a38d456f45d5044ec75a86458cc3eb6974e7256e14b1279409385784d1
SSDEEP

196608:PxJP9wudlydSXfZT1q6axc0a10aXERxZuahZ:Px/w2yKfS/c9J4Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
992597951b73ff1193cbcdee202aaf6758838d6a6b5e4b14d35c9a5d339b8705

Files

992597951b73ff1193cbcdee202aaf6758838d6a6b5e4b14d35c9a5d339b8705
.exe windows:4 windows x86 arch:x86

aefd2ba79f4a30d123544d14415dd5f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetProcAddress
GetModuleHandleExA
lstrcpynA
RtlMoveMemory
GetCurrentProcess
ReadProcessMemory
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CloseHandle
WriteFile
CreateFileA
ReadFile
GetFileSize
GetLocalTime
FreeLibrary
LoadLibraryA
LCMapStringA

msvcrt

atoi
_ftol
??2@YAPAXI@Z
??3@YAXPAX@Z
_atoi64
atof
sprintf
free
malloc
strchr
realloc
modf
memmove
strncmp
__CxxFrameHandler

user32

GetWindowTextA
GetWindowTextLengthA
GetWindowLongA
SetWindowPos
ScreenToClient
GetWindowRect
SetWindowLongA
ShowWindow
GetDlgItem
wsprintfA
PostQuitMessage
DestroyWindow
DispatchMessageA
TranslateMessage
SendMessageA
GetMessageA
UpdateWindow
CreateDialogIndirectParamA
SetWindowTextA
MessageBoxA

shlwapi

PathFileExistsA

Sections

.text
Size: 764KB - Virtual size: 761KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

xeng
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cxxx
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_MEM_EXECUTE

Sharing

General

Malware Config

Signatures

Files

aefd2ba79f4a30d123544d14415dd5f4

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

shlwapi

Sections

.text Size: 764KB - Virtual size: 761KB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 100KB - Virtual size: 305KB

.rsrc Size: 88KB - Virtual size: 86KB

xeng Size: 364KB - Virtual size: 364KB

.cxxx Size: 5.3MB - Virtual size: 5.3MB

.text
Size: 764KB - Virtual size: 761KB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 100KB - Virtual size: 305KB

.rsrc
Size: 88KB - Virtual size: 86KB

xeng
Size: 364KB - Virtual size: 364KB

.cxxx
Size: 5.3MB - Virtual size: 5.3MB