1f37894964fc5bb1fc120c6c31fd41f24a164fc3e58d6f16ca8e6e1c3fea7a83

Sharing

Copy URL

Twitter E-mail

General

Target

1f37894964fc5bb1fc120c6c31fd41f24a164fc3e58d6f16ca8e6e1c3fea7a83
Size

68KB
MD5

07d0bf5a9a9c0b0e045cafde13754851
SHA1

1d6cbfc51ef8fb405dbb526823ea29fa1469a8d2
SHA256

1f37894964fc5bb1fc120c6c31fd41f24a164fc3e58d6f16ca8e6e1c3fea7a83
SHA512

170b3f0c56dc6d291006aca9db5c022609b5f290a9060775e575d8d4e67f91299ef1208ef8e4d9773bac4fa8d26c5119ab350171a76c413943f533bc38c6b72a
SSDEEP

768:TFUT4oqwGxQp4ZpWTE5osErXrJeMnOb1ORItg57RtI/D/iebtY+k99hQTrY:TFUPGQ035kJdObcetgFRib/ieb/yhQ3Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f37894964fc5bb1fc120c6c31fd41f24a164fc3e58d6f16ca8e6e1c3fea7a83

Files

1f37894964fc5bb1fc120c6c31fd41f24a164fc3e58d6f16ca8e6e1c3fea7a83
.exe windows:4 windows x86 arch:x86

e404d0ec072afabba9b2d02718f3bf25

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
GetSystemDirectoryW
LoadLibraryW
Sleep
GetVersionExW
GetExitCodeProcess
ReadFile
CreateFileW
FlushFileBuffers
GetStdHandle
GetLastError
WriteFile
GetProcAddress
Process32FirstW
ProcessIdToSessionId
CreatePipe
Process32NextW
lstrcatW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
CreateThread
WaitNamedPipeW
WaitForSingleObject
SetHandleInformation
CreateProcessW
SetLastError
FreeLibrary
CreateFileA
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
ExitProcess
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSection
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapReAlloc
VirtualAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
RtlUnwind
HeapSize

advapi32

DuplicateTokenEx
LookupPrivilegeValueW
CreateProcessAsUserW
OpenProcessToken
AdjustTokenPrivileges

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e404d0ec072afabba9b2d02718f3bf25

Headers

File Characteristics

Imports

kernel32

advapi32

wtsapi32

userenv

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB