4336baec00605852af5cc8bd1d16062d9284c49c13a2de7943526d338c2365b7

Sharing

Copy URL

Twitter E-mail

General

Target

4336baec00605852af5cc8bd1d16062d9284c49c13a2de7943526d338c2365b7
Size

13.8MB
MD5

c4582eeb3067dac7496b9bd05783574f
SHA1

a4ece6f28cf4b6e61f478e3a191d5295884517dd
SHA256

4336baec00605852af5cc8bd1d16062d9284c49c13a2de7943526d338c2365b7
SHA512

b7381c4fef6e628ceb678213d5fbb6adbe68b0b81b3e88ab736db704e690cee6286dfec0a28187cc853964e8d6efaf178e78018c871df6826d0a3eda6790c18a
SSDEEP

24576:88ZMAyYW////////////////////////////////////////////////////////:TZa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
4336baec00605852af5cc8bd1d16062d9284c49c13a2de7943526d338c2365b7

Files

4336baec00605852af5cc8bd1d16062d9284c49c13a2de7943526d338c2365b7
.exe windows:5 windows x86 arch:x86

71b0f0cb2cb6c557a1ff35b75a3ccbcd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\fiti\20\sefe\bida31\tuyuduxizer_rab.pdb

Imports

kernel32

FindResourceW
InterlockedIncrement
QueryDosDeviceA
InterlockedCompareExchange
FindCloseChangeNotification
GetComputerNameW
CreateHardLinkA
GetTickCount
GetConsoleAliasesLengthA
GlobalFindAtomA
SetConsoleMode
WriteConsoleW
CompareStringW
GetStartupInfoA
GetLastError
SetComputerNameExA
GetProcAddress
VirtualAlloc
SetComputerNameA
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
AddAtomW
lstrcmpiW
GetModuleHandleA
PurgeComm
DeleteFileW
GetCurrentProcessId
DebugBreak
ResetWriteWatch
ReadConsoleOutputCharacterW
ResumeThread
SetLastError
GetConsoleAliasesLengthW
GetModuleHandleW
Sleep
ExitProcess
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
CreateFileA
WideCharToMultiByte
HeapAlloc
HeapReAlloc
HeapSize
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
SetFilePointer
SetEndOfFile
GetProcessHeap
ReadFile
WriteConsoleA
GetConsoleOutputCP

gdi32

GetCharABCWidthsFloatA

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.6MB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71b0f0cb2cb6c557a1ff35b75a3ccbcd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 9KB - Virtual size: 4.1MB

.rsrc Size: 13.6MB - Virtual size: 121KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 9KB - Virtual size: 4.1MB

.rsrc
Size: 13.6MB - Virtual size: 121KB