272720cdecfc5ba5d2831ba5e623bac023246852e9b1bdfecc110e2c4ba1cc7c

Sharing

Copy URL Twitter E-mail

General

Target

272720cdecfc5ba5d2831ba5e623bac023246852e9b1bdfecc110e2c4ba1cc7c
Size

1.1MB
MD5

2e74123fd9b7030abd33d26c5f18d108
SHA1

51ec35223343b8762ef7f890dda5202375bb68d9
SHA256

272720cdecfc5ba5d2831ba5e623bac023246852e9b1bdfecc110e2c4ba1cc7c
SHA512

c2c27fb5db6328e91c358c9766b2768b1c1ee2c1960b60bcda1726333e820f3caa7818f4cd7c31e92b172b3f301f2e831aab07d416179c3dab67ad121de03742
SSDEEP

24576:Nd5+j7o3mwNi5AH4XE9IvNUMhhloH3izQCTsbrUJyrXUxs7i4qmx06E:NnMnwNi5AH4+IvmMhhloXiz9QbrUJsXq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
272720cdecfc5ba5d2831ba5e623bac023246852e9b1bdfecc110e2c4ba1cc7c

Files

272720cdecfc5ba5d2831ba5e623bac023246852e9b1bdfecc110e2c4ba1cc7c
.exe windows:5 windows x86 arch:x86

7b2c4235a00e08021049cd62a817afc5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
lstrlenW
WideCharToMultiByte
MoveFileExW
GetTempFileNameW
GetTempPathW
DeleteFileW
MoveFileW
WriteFile
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
Sleep
GetModuleFileNameW
GetComputerNameA
GetSystemTime
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetCurrentThreadId
SetUnhandledExceptionFilter
ExitProcess
DecodePointer
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
EncodePointer
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapReAlloc
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
MultiByteToWideChar
FreeLibrary
InterlockedExchange
GetStringTypeW
SetStdHandle
WriteConsoleW
SetEndOfFile
GetProcessHeap
CloseHandle
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
GetModuleHandleA
CreateProcessW
LoadLibraryW
SystemTimeToFileTime
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LoadLibraryA
TlsGetValue
GetProcAddress
LocalAlloc

advapi32

CreateServiceW
RegSetValueExW
RegCreateKeyExW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
StartServiceW
CloseServiceHandle
RegCloseKey
RegOpenKeyExW
CryptAcquireContextW
CryptReleaseContext
GetUserNameW
GetUserNameA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryValueExW

ole32

CoCreateInstance
CoInitialize

shlwapi

PathAddExtensionW
PathAppendW
PathRemoveExtensionW
PathFileExistsW
PathIsRootW

Sections

.text
Size: 384KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.const
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 709KB - Virtual size: 730KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b2c4235a00e08021049cd62a817afc5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

shlwapi

Sections

.text Size: 384KB - Virtual size: 383KB

.const Size: 8KB - Virtual size: 8KB

.data Size: 709KB - Virtual size: 730KB

.rsrc Size: 59KB - Virtual size: 58KB

.text
Size: 384KB - Virtual size: 383KB

.const
Size: 8KB - Virtual size: 8KB

.data
Size: 709KB - Virtual size: 730KB

.rsrc
Size: 59KB - Virtual size: 58KB