1f4e985df466ddbe07cc8fb5354d16106dfabfb5eaf45929422f73f814788d05

Sharing

Copy URL

Twitter E-mail

General

Target

1f4e985df466ddbe07cc8fb5354d16106dfabfb5eaf45929422f73f814788d05
Size

8KB
MD5

a4ddfbaa210f60ba65860087da430052
SHA1

2bc806a65a308ebdd55005307b67cb87ac4c64e2
SHA256

1f4e985df466ddbe07cc8fb5354d16106dfabfb5eaf45929422f73f814788d05
SHA512

5b8f8e7c57840521acc9f4739a400fc3e7dba6c9e3fda0c85e025f0801d8dcf417d2437c03d730d4a0fbbb2f5a6075d6d282737ce9e342e62438ed973e8c45f8
SSDEEP

192:FyVWJ1BqZvl+LKjGaiqmhDkbkNMTcWdi6FkqW04M:FoE1BAULKaKGMTJs6YM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f4e985df466ddbe07cc8fb5354d16106dfabfb5eaf45929422f73f814788d05

Files

1f4e985df466ddbe07cc8fb5354d16106dfabfb5eaf45929422f73f814788d05
.exe windows:4 windows x86 arch:x86

126cb21691cdca940770a1722e68ce6c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\users\rainbow\desktop\controlwinposclient\release\controlWinposClient.pdb

Imports

kernel32

GetPriorityClass
OpenProcess
CreateToolhelp32Snapshot
Process32First
TerminateProcess
Process32Next
Sleep
WinExec
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime

msvcp80

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr80

exit
sprintf
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
_XcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_exit
_cexit
__getmainargs
_amsg_exit
_time64
fwrite
fopen
fclose
__set_app_type
_localtime64
__initenv
_getcwd
__CxxFrameHandler3
memset

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

126cb21691cdca940770a1722e68ce6c

Headers

File Characteristics

PDB Paths

Imports

kernel32

msvcp80

msvcr80

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 912B

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 912B

.rsrc
Size: 512B - Virtual size: 4KB