ac8b08f7ed167b936e2b5c04ef87b1d44d5c8492af108465eea905342710d78e

Sharing

Copy URL Twitter E-mail

General

Target

ac8b08f7ed167b936e2b5c04ef87b1d44d5c8492af108465eea905342710d78e
Size

138KB
MD5

501ad13074f14f83b0c9382c707edd15
SHA1

bd9cd3aab9c9e6a9eb0fff8de68dcb483cc3e965
SHA256

ac8b08f7ed167b936e2b5c04ef87b1d44d5c8492af108465eea905342710d78e
SHA512

48434ade8232866cbf6b452ccff0c7cdf24be27891ce2d7f15ff60d57fc0a626542e161a44a7b4326a6daa792eb0e795db17bdc80bd05744c0cdf8dc6d531079
SSDEEP

3072:uie0uZOlEgdo6Gfg+KVeqiNDF4VwH9blj:uiebrfFIeEyj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac8b08f7ed167b936e2b5c04ef87b1d44d5c8492af108465eea905342710d78e

Files

ac8b08f7ed167b936e2b5c04ef87b1d44d5c8492af108465eea905342710d78e
.exe windows:4 windows x86 arch:x86

00d2346b03f86507d07089e6e4c6e6bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
lstrlenW
WideCharToMultiByte
FindFirstFileW
FindClose
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetLocalTime
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
LocalFree
GetCommandLineW
GetModuleFileNameA
CloseHandle
WriteFile
CreateFileA
FindNextFileA
FindFirstFileA
GetPrivateProfileStringA
ReadFile
GetFileSize
SetFilePointer
GetUserDefaultLCID
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
LCMapStringA

ole32

CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize

oleaut32

VariantChangeType
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime

msvcrt

__CxxFrameHandler
realloc
memmove
_atoi64
modf
strncmp
strncpy
_ftol
atoi
_CIfmod
floor
sprintf
??2@YAPAXI@Z
malloc
free
??3@YAXPAX@Z
strchr

user32

PeekMessageA
GetMessageA
TranslateMessage
MessageBoxA
wsprintfA
DispatchMessageA

shell32

CommandLineToArgvW

shlwapi

PathFileExistsA

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

00d2346b03f86507d07089e6e4c6e6bd

Headers

File Characteristics

Imports

kernel32

ole32

oleaut32

msvcrt

user32

shell32

shlwapi

Sections

.text Size: 117KB - Virtual size: 116KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 13KB - Virtual size: 61KB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: 117KB - Virtual size: 116KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 13KB - Virtual size: 61KB

.rsrc
Size: 4KB - Virtual size: 4KB