026c355aabe9eaa144803ccfadafca39359e916ee3bf6cafc77d9887ba910a44

Sharing

Copy URL

Twitter E-mail

General

Target

026c355aabe9eaa144803ccfadafca39359e916ee3bf6cafc77d9887ba910a44
Size

69KB
MD5

91daa09da806c089dc5f6f605c59cbca
SHA1

90220c45b13d41a0954b758d8d2776985464c60e
SHA256

026c355aabe9eaa144803ccfadafca39359e916ee3bf6cafc77d9887ba910a44
SHA512

64e13b30cd8e2b117e420a382fd9a52a9167699568a9fd5d4c64cd0bfc6408d5e3fc62ec2897cb5274c6cdb8a4737959fafabfd2edfc5b80169af3cbe3b2dac6
SSDEEP

1536:Jripv6js0rNR/+uP2aWNClGSzVAL5xdaeAhD7Kif1:pipvSsE+E2aWNCltzVO5ja1h/Kif1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0581a38d1dc61e0da50722cb6c4253d603cc7965c87e1e42db548460d4abdcae.bin

Files

026c355aabe9eaa144803ccfadafca39359e916ee3bf6cafc77d9887ba910a44
.zip

Password: infected
0581a38d1dc61e0da50722cb6c4253d603cc7965c87e1e42db548460d4abdcae.bin
.exe windows:5 windows x86 arch:x86

ada579361a8441a77318bb8786829f7e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

RealGetWindowClassA
CreateIconFromResourceEx
MsgWaitForMultipleObjects
GetClipboardData
MessageBoxIndirectA
MessageBoxW
SetWindowTextW
SetTimer
GetClassLongA
TranslateAcceleratorA
WinHelpW
DrawIconEx
DdeDisconnectList

urlmon

CoInternetCompareUrl
SetSoftwareUpdateAdvertisementState
RegisterMediaTypes

wininet

InternetCanonicalizeUrlA
InternetCreateUrlA
RetrieveUrlCacheEntryStreamW
InternetSetOptionExA
FtpRenameFileA
InternetReadFileExW
InternetCheckConnectionW

gdi32

BeginPath
CreateColorSpaceW
ChoosePixelFormat
CloseEnhMetaFile
CreateDCW
CombineRgn

kernel32

LCMapStringW
ReadFile
HeapSize
IsProcessorFeaturePresent
GetStringTypeW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
RtlUnwind
MultiByteToWideChar
SetStdHandle
IsValidCodePage
IsDebuggerPresent
VirtualLock
GetLastError
VirtualAlloc
GetSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryA
EnumDateFormatsW
GetDefaultCommConfigW
FoldStringA
SetupComm
GetFileType
WriteConsoleW
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
HeapSetInformation
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
CreateFileW
CloseHandle
HeapCreate
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
SetHandleCount
Sleep
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

ada579361a8441a77318bb8786829f7e

Headers

DLL Characteristics

File Characteristics

Imports

user32

urlmon

wininet

gdi32

kernel32

Sections

.text Size: 102KB - Virtual size: 101KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 5KB - Virtual size: 15KB

.rsrc Size: 25KB - Virtual size: 25KB

.text
Size: 102KB - Virtual size: 101KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 5KB - Virtual size: 15KB

.rsrc
Size: 25KB - Virtual size: 25KB