5fdcce81a6b2e5b913807be9f8995196c72c9947ff850365f670b87fa01ca1fd

Sharing

Copy URL Twitter E-mail

General

Target

5fdcce81a6b2e5b913807be9f8995196c72c9947ff850365f670b87fa01ca1fd
Size

1.1MB
MD5

3a35bfe52c1ed44a1edf963724c99700
SHA1

7cad18fb9447bb0380553cae6116ec0e6610bd96
SHA256

5fdcce81a6b2e5b913807be9f8995196c72c9947ff850365f670b87fa01ca1fd
SHA512

72ab00f5d5e3addb1bee1b03eb0dba09c15d31ee4eeaaab56d4394dcc9551bcbb44588f4fd33766084537a9c12c7b4d0413f41fcf043eb9b98a7e761998b53f1
SSDEEP

24576:Nd5+j7o3mwNi5A/rVBnLBgpL2huDx0dSq6P6SZE:NnMnwNi5A/pQpq2NqOZE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5fdcce81a6b2e5b913807be9f8995196c72c9947ff850365f670b87fa01ca1fd

Files

5fdcce81a6b2e5b913807be9f8995196c72c9947ff850365f670b87fa01ca1fd
.exe windows:5 windows x86 arch:x86

7b2c4235a00e08021049cd62a817afc5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
lstrlenW
WideCharToMultiByte
MoveFileExW
GetTempFileNameW
GetTempPathW
DeleteFileW
MoveFileW
WriteFile
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
Sleep
GetModuleFileNameW
GetComputerNameA
GetSystemTime
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetCurrentThreadId
SetUnhandledExceptionFilter
ExitProcess
DecodePointer
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
EncodePointer
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapReAlloc
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
MultiByteToWideChar
FreeLibrary
InterlockedExchange
GetStringTypeW
SetStdHandle
WriteConsoleW
SetEndOfFile
GetProcessHeap
CloseHandle
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
GetModuleHandleA
CreateProcessW
LoadLibraryW
SystemTimeToFileTime
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LoadLibraryA
TlsGetValue
GetProcAddress
LocalAlloc

advapi32

CreateServiceW
RegSetValueExW
RegCreateKeyExW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
StartServiceW
CloseServiceHandle
RegCloseKey
RegOpenKeyExW
CryptAcquireContextW
CryptReleaseContext
GetUserNameW
GetUserNameA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryValueExW

ole32

CoCreateInstance
CoInitialize

shlwapi

PathAddExtensionW
PathAppendW
PathRemoveExtensionW
PathFileExistsW
PathIsRootW

Sections

.text
Size: 384KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.const
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 709KB - Virtual size: 730KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b2c4235a00e08021049cd62a817afc5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

shlwapi

Sections

.text Size: 384KB - Virtual size: 383KB

.const Size: 8KB - Virtual size: 8KB

.data Size: 709KB - Virtual size: 730KB

.rsrc Size: 59KB - Virtual size: 58KB

.text
Size: 384KB - Virtual size: 383KB

.const
Size: 8KB - Virtual size: 8KB

.data
Size: 709KB - Virtual size: 730KB

.rsrc
Size: 59KB - Virtual size: 58KB