5bac8aa27a897f6c643f979f8af524197b7365f1c4b100b719a9120c4efb9cbe

Sharing

Copy URL Twitter E-mail

General

Target

5bac8aa27a897f6c643f979f8af524197b7365f1c4b100b719a9120c4efb9cbe
Size

424KB
MD5

12cd58728311161dc7e8cd8353f65444
SHA1

852a6815f60537b172fdb02fe686aa826fb2a346
SHA256

5bac8aa27a897f6c643f979f8af524197b7365f1c4b100b719a9120c4efb9cbe
SHA512

cb71d0c04ed68a20876792e064c1d86f04dc42779467e223439a4b4b5b4fe3273571607b473e0a477cfe9a73c0c03a8fc8cdbe9eca064ac324409a375ba9f114
SSDEEP

6144:uvL9ccHfdMeQ/A+uTf7uDfd5+ERpNeeIRrVL/vW4upYFwpNR/hhx/:IxbHfb2UTfaDz+ERpNmL/ORUoJTx/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bac8aa27a897f6c643f979f8af524197b7365f1c4b100b719a9120c4efb9cbe

Files

5bac8aa27a897f6c643f979f8af524197b7365f1c4b100b719a9120c4efb9cbe
.exe windows:5 windows x86 arch:x86

0651447fc597be0cf799d5a22cb823da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedDecrement
CreateJobObjectW
GetTimeFormatA
GetModuleHandleW
GetTickCount
EnumCalendarInfoExW
GetConsoleAliasesLengthA
FormatMessageA
GetSystemTimes
LoadLibraryW
SetVolumeMountPointA
WriteConsoleOutputA
GetStringTypeExW
FindNextVolumeW
GetConsoleAliasW
SetTimeZoneInformation
FileTimeToSystemTime
GetModuleFileNameW
SetConsoleTitleA
RaiseException
EnumCalendarInfoW
GetConsoleAliasesW
SetLastError
GetThreadLocale
GetProcAddress
SetVolumeLabelW
VerLanguageNameW
BuildCommDCBW
LoadLibraryA
LocalAlloc
SetConsoleOutputCP
GetProcessAffinityMask
PurgeComm
EnumDateFormatsW
CompareStringA
DeleteCriticalSection
DeleteAtom
OpenFileMappingA
GetStringTypeExA
GetComputerNameA
MultiByteToWideChar
GetLastError
HeapFree
HeapReAlloc
HeapAlloc
GetStartupInfoW
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapCreate
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
HeapSize
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
ReadFile
CreateFileA
CloseHandle
GetModuleHandleA

user32

SetActiveWindow

advapi32

RevertToSelf

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 23.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0651447fc597be0cf799d5a22cb823da

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 65KB - Virtual size: 64KB

.rdata Size: 246KB - Virtual size: 245KB

.data Size: 21KB - Virtual size: 23.5MB

.rsrc Size: 91KB - Virtual size: 91KB

.text
Size: 65KB - Virtual size: 64KB

.rdata
Size: 246KB - Virtual size: 245KB

.data
Size: 21KB - Virtual size: 23.5MB

.rsrc
Size: 91KB - Virtual size: 91KB