2142b2bb9ab6035798252d4ca9b196285f980f69a86b7e96a77a642b19a43b3a

Sharing

Copy URL

Twitter E-mail

General

Target

2142b2bb9ab6035798252d4ca9b196285f980f69a86b7e96a77a642b19a43b3a
Size

484KB
MD5

0d75a7e4e8d3a3e0381c07ed32717ab5
SHA1

55d0b1e0903c60b16779ddc247b4af6bb013078d
SHA256

2142b2bb9ab6035798252d4ca9b196285f980f69a86b7e96a77a642b19a43b3a
SHA512

3a2cca28e36766adb2c8ca3c1949fef6ac5f19094e0ac64e7141e058fea938df223a679318bd0689917e8707876eb3e9a85d92f34d14eb8bb8cd5ba95c90bc81
SSDEEP

12288:a8UQ26YJHd8MY11RinYX2B7X+90qsC+Q48:aV6nAX+28+Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2142b2bb9ab6035798252d4ca9b196285f980f69a86b7e96a77a642b19a43b3a

Files

2142b2bb9ab6035798252d4ca9b196285f980f69a86b7e96a77a642b19a43b3a
.exe windows:6 windows x86 arch:x86

10de526879465d471e03c0f9c17033b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
WriteConsoleW
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
QueryPerformanceCounter
QueryPerformanceFrequency
GetLastError
SetLastError
VerifyVersionInfoW
VerSetConditionMask
CloseHandle
MultiByteToWideChar
CreateFileW
GetACP
DeviceIoControl
HeapSize
HeapReAlloc
ReadConsoleW
ReadFile
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeSListHead
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
RtlUnwind
InterlockedPushEntrySList
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetEndOfFile

user32

EndPaint
BeginPaint
LoadImageW
GetMessageW
DefWindowProcW
DestroyWindow
MessageBoxExW
CreateWindowExW
SendMessageW
GetSystemMetrics
SetWindowTextW
RegisterClassExW
ShowWindow
DispatchMessageW
TranslateMessage
PostQuitMessage

gdi32

SetTextColor
SetBkMode
CreateFontW

comdlg32

GetSaveFileNameW

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExW

ws2_32

WSAStartup
WSACleanup
gethostname

Sections

.text
Size: 341KB - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10de526879465d471e03c0f9c17033b4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

ws2_32

Sections

.text Size: 341KB - Virtual size: 341KB

.rdata Size: 90KB - Virtual size: 89KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 341KB - Virtual size: 341KB

.rdata
Size: 90KB - Virtual size: 89KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 17KB - Virtual size: 16KB