d324ce68863f8d916baab406e450596fe877284a9b0b2e1f6789d1502aacaeb9

General

Target

d324ce68863f8d916baab406e450596fe877284a9b0b2e1f6789d1502aacaeb9
Size

409KB
MD5

66b478829f0b682b95e13e09bfe6582c
SHA1

aec0fda0d671bfce39b2d5ecca65131b2fa1f0aa
SHA256

d324ce68863f8d916baab406e450596fe877284a9b0b2e1f6789d1502aacaeb9
SHA512

917b66dff514ea6b96ef525e69b154c1cda46dc0f8a1bf9d94fa3ea616e95ecb530197c0be633b1aadb96cb9325de6c3c88001440e6cd65fc3c0985d4a3fb282
SSDEEP

6144:SpW8PgRYXclg5n+zV/t2d40t0IG7Ucq6vSLaPijjzDeTQ4Fb4T:SpW8aYXng7i4dIsUczanzDeTQV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d324ce68863f8d916baab406e450596fe877284a9b0b2e1f6789d1502aacaeb9

Files

d324ce68863f8d916baab406e450596fe877284a9b0b2e1f6789d1502aacaeb9
.exe windows:5 windows x86 arch:x86

25d02a8f95b6d084a8755e0d5fbed8b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PeekNamedPipe
InterlockedCompareExchange
SetComputerNameW
GetTickCount
GetNumberFormatA
GetUserDefaultLangID
TlsSetValue
GlobalAlloc
LoadLibraryW
lstrcatA
QueryInformationJobObject
GetACP
IsBadStringPtrA
GetLastError
SetLastError
GetProcAddress
GetDiskFreeSpaceW
LoadLibraryA
FindFirstVolumeMountPointW
SetConsoleCtrlHandler
FoldStringW
GetModuleFileNameA
LoadLibraryExA
BuildCommDCBA
OutputDebugStringA
GetWindowsDirectoryW
WriteProcessMemory
HeapFree
EncodePointer
DecodePointer
HeapReAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
HeapCreate
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
HeapSize
GetModuleHandleW
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapAlloc
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteConsoleW
MultiByteToWideChar
SetFilePointer
SetStdHandle
RtlUnwind
GetCPInfo
GetOEMCP
IsValidCodePage
CreateFileW
CloseHandle
GetStringTypeW
RaiseException
LCMapStringW
IsProcessorFeaturePresent

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 196KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25d02a8f95b6d084a8755e0d5fbed8b0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 196KB - Virtual size: 2.4MB

.rsrc Size: 150KB - Virtual size: 149KB

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 196KB - Virtual size: 2.4MB

.rsrc
Size: 150KB - Virtual size: 149KB