8a2556d24259cc1de147b369efdf4ee4b6563e8f74b72b667c5b1523b3e0c920

Sharing

Copy URL

Twitter E-mail

General

Target

8a2556d24259cc1de147b369efdf4ee4b6563e8f74b72b667c5b1523b3e0c920
Size

3.1MB
MD5

e97e5606c3addf0b3329d921de021a96
SHA1

04619bb2cfec145c8d67b6b19d3dfc280f4ce185
SHA256

8a2556d24259cc1de147b369efdf4ee4b6563e8f74b72b667c5b1523b3e0c920
SHA512

417ae10b6553d60e4a75baffdfd5bea40e91503bbd48aecf538e28fb61615cbf36e84fc155b149a23dbc236f7bf37def186f4fe9ccf328b0c1a217f145ccd440
SSDEEP

98304:ZENVRJkJJ0H/ps1RCyTO9rOHVASOIPpH0CJ:ZEzRJkUHGCyTbHVmqF0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a2556d24259cc1de147b369efdf4ee4b6563e8f74b72b667c5b1523b3e0c920

Files

8a2556d24259cc1de147b369efdf4ee4b6563e8f74b72b667c5b1523b3e0c920
.exe windows:6 windows x86 arch:x86

ba95dd6e7ceca021b89bc824f71bab13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ddraw

DirectDrawCreate

dsound

ord1

winmm

mmioDescend

dinput

DirectInputCreateA

wsock32

gethostbyname

lua51

luaL_addvalue

dbghelp

MiniDumpWriteDump

kernel32

FreeEnvironmentStringsW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ClientToScreen
CharUpperBuffW

gdi32

CreateRectRgn

advapi32

RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

ShellExecuteA

ole32

CoInitialize

netapi32

Netbios

iphlpapi

GetAdaptersInfo

imm32

ImmAssociateContext

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 515.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba95dd6e7ceca021b89bc824f71bab13

Headers

DLL Characteristics

File Characteristics

Imports

ddraw

dsound

winmm

dinput

wsock32

lua51

dbghelp

kernel32

user32

gdi32

advapi32

shell32

ole32

netapi32

iphlpapi

imm32

wtsapi32

Sections

.text Size: - Virtual size: 1.2MB

.rdata Size: - Virtual size: 129KB

.data Size: - Virtual size: 515.1MB

.tls Size: 512B - Virtual size: 9B

.vmp0 Size: - Virtual size: 2.5MB

.vmp1 Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 512B - Virtual size: 308B

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: - Virtual size: 1.2MB

.rdata
Size: - Virtual size: 129KB

.data
Size: - Virtual size: 515.1MB

.tls
Size: 512B - Virtual size: 9B

.vmp0
Size: - Virtual size: 2.5MB

.vmp1
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 512B - Virtual size: 308B

.rsrc
Size: 2KB - Virtual size: 2KB