2982222c5a94fed295856c54fe76f34c1f475905dc548d386bd53c5a6ae83fa2

Sharing

Copy URL

Twitter E-mail

General

Target

2982222c5a94fed295856c54fe76f34c1f475905dc548d386bd53c5a6ae83fa2
Size

3.6MB
MD5

44ca2487d1d10874b20d67da5cbb9663
SHA1

faf314d0874919bf5a38ed70cb129d8e6ec18720
SHA256

2982222c5a94fed295856c54fe76f34c1f475905dc548d386bd53c5a6ae83fa2
SHA512

726f959799a23d042d63a07d1fc1858e4825c636a691874a69cde004dff357e8b87c2d1acce854ad4eb87e9968d969e1653f355cdab05be63657c73f2f454547
SSDEEP

49152:V9hD/eTVBtxro+/OEcJS679djc3AOP89:3hD/eTV1F/OEi7j2O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2982222c5a94fed295856c54fe76f34c1f475905dc548d386bd53c5a6ae83fa2

Files

2982222c5a94fed295856c54fe76f34c1f475905dc548d386bd53c5a6ae83fa2
.exe windows:6 windows x86 arch:x86

f888732a0fcc961a00e3074bf7183924

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
CreateFileA
WriteFile
CloseHandle
GetLastError
CreateActCtxA
ActivateActCtx
DeactivateActCtx
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
WaitForSingleObject
ReleaseActCtx
CreateFileMappingA
MapViewOfFile
ExitProcess
VirtualAlloc
CreateThread
EnterCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
RaiseException

avifil32

AVIFileOpenA

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f888732a0fcc961a00e3074bf7183924

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

avifil32

Sections

.text Size: 81KB - Virtual size: 81KB

.rdata Size: 2.3MB - Virtual size: 2.3MB

.data Size: 1.3MB - Virtual size: 1.3MB

.gfids Size: 512B - Virtual size: 172B

.rodata Size: 512B - Virtual size: 320B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 81KB - Virtual size: 81KB

.rdata
Size: 2.3MB - Virtual size: 2.3MB

.data
Size: 1.3MB - Virtual size: 1.3MB

.gfids
Size: 512B - Virtual size: 172B

.rodata
Size: 512B - Virtual size: 320B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 6KB - Virtual size: 5KB