1038e9f6d8ad31445b976955f227473bdc2be0c10b11ac2c6d162e3b498c990d

Sharing

Copy URL Twitter E-mail

General

Target

1038e9f6d8ad31445b976955f227473bdc2be0c10b11ac2c6d162e3b498c990d
Size

6.7MB
MD5

ebef6679f429e9e9503993bc896ecc0b
SHA1

cc0c862794b177330ff38fb737320b72bc8d8e49
SHA256

1038e9f6d8ad31445b976955f227473bdc2be0c10b11ac2c6d162e3b498c990d
SHA512

8e34721ed315c13ced0910ae44c9b06da2ace0b4284eb042d32e6846091e491221b25af1dcabfd58e925b29f1bab9a06f4a1c4adffc394c344eded821bab33f5
SSDEEP

98304:C6fn4g2cUudnMj1mV6x0XWdSwpmMR2Q8GY89aH7L+RDP1cH10H1WxYKPTr+aJJFT:0g9Rw1mPXWPpjdibLWT1cVagT6ah8i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1038e9f6d8ad31445b976955f227473bdc2be0c10b11ac2c6d162e3b498c990d

Files

1038e9f6d8ad31445b976955f227473bdc2be0c10b11ac2c6d162e3b498c990d
.exe windows:5 windows x86 arch:x86

42e4eb08dd1cddcf3850090bc5b75d2c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\projects\funny\publish\jsqyz_free.pdb

Imports

kernel32

GetVersionExA
VirtualAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperA

gdi32

GetBkColor

msimg32

AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter

advapi32

RegEnumKeyA

shell32

DragFinish

comctl32

InitCommonControlsEx

shlwapi

PathRenameExtensionA

oledlg

ord8

ole32

CoFreeUnusedLibraries

oleaut32

VariantCopy

gdiplus

GdipAddPathEllipseI

ws2_32

closesocket

psapi

GetModuleFileNameExA

crypt32

CertCloseStore

ntdll

ZwClose

winmm

mciSendStringA

wininet

InternetReadFile

Sections

.text
Size: - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data30
Size: - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data31
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42e4eb08dd1cddcf3850090bc5b75d2c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

ws2_32

psapi

crypt32

ntdll

winmm

wininet

Sections

.text Size: - Virtual size: 403KB

.rdata Size: - Virtual size: 110KB

.data Size: - Virtual size: 35KB

.data30 Size: - Virtual size: 6.8MB

.data31 Size: 6.7MB - Virtual size: 6.7MB

.reloc Size: 512B - Virtual size: 232B

.rsrc Size: 69KB - Virtual size: 68KB

.text
Size: - Virtual size: 403KB

.rdata
Size: - Virtual size: 110KB

.data
Size: - Virtual size: 35KB

.data30
Size: - Virtual size: 6.8MB

.data31
Size: 6.7MB - Virtual size: 6.7MB

.reloc
Size: 512B - Virtual size: 232B

.rsrc
Size: 69KB - Virtual size: 68KB