b2ed5b0b461f9a722077f07bc49cd9d1c5e5cae28c90ae6d4c82acb7262b4d54

Sharing

Copy URL Twitter E-mail

General

Target

b2ed5b0b461f9a722077f07bc49cd9d1c5e5cae28c90ae6d4c82acb7262b4d54
Size

49KB
MD5

ced3ecd48c7fb540c77c804427e10ad8
SHA1

0ecd81f78fdbf26947e916923ea4e8795758a83e
SHA256

b2ed5b0b461f9a722077f07bc49cd9d1c5e5cae28c90ae6d4c82acb7262b4d54
SHA512

9b10b2559f1d0e3ce701ae6d9c832df78f8c65388ca94d69f33f4d5b044441b7a809c99270d9d79496e98415392feb232e7509b97fc8f6e8308a673cd94f9b18
SSDEEP

768:i3TOElCT5FEyCNEaZOCGe0Qb04tH/SxBVEKJl1iHVQ:i36bFFEykEaZOCGeJ1pSxDp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2ed5b0b461f9a722077f07bc49cd9d1c5e5cae28c90ae6d4c82acb7262b4d54

Files

b2ed5b0b461f9a722077f07bc49cd9d1c5e5cae28c90ae6d4c82acb7262b4d54
.exe windows:5 windows x86 arch:x86

0f9d68732669b5e16a71ed4a2008c106

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\lab-4.0\chkdb\chkdb32.pdb

Imports

kernel32

TlsGetValue
FreeLibrary
GetProcAddress
LoadLibraryA
FindFirstFileA
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
MulDiv
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount
TlsAlloc
GetSystemTimeAsFileTime
TlsSetValue
GetCommandLineA
GetCurrentDirectoryA
GetComputerNameA
IsDebuggerPresent
CreateThread

user32

SetFocus
GetSystemMetrics
SetForegroundWindow
SetWindowPlacement
GetSysColor
LoadIconA
LoadCursorA
RegisterClassA
PostMessageA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowA
DefWindowProcA
MoveWindow
PostQuitMessage
SendMessageA
GetClientRect
GetScrollInfo
SetScrollInfo
SetWindowLongA
GetDC
ReleaseDC
InvalidateRect
BeginPaint
EndPaint
GetWindowLongA
GetWindowPlacement

gdi32

TextOutA
GetTextMetricsA
GetStockObject
DeleteObject
CreateSolidBrush

debug

debug_init
printd

labdb

dbpos
comdta
dbterm
dbinit
dialog_syserr
dbclose
dbopen
examine_results
dbnext
resultrec_spcxrf
dbreread
dbdelete
btrv

labfunc

Tx
edit_uuid
DLM_free
DLM_procedure
DLM_load

labtest

open_testdict
result_test
close_testdict

comctl32

ord17

msvcr90

memset
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_read
free
_lseek
_write
vsprintf
memcmp
memcpy
memmove
malloc
printf
_close
_open
sprintf
__p__fmode
_encode_pointer
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
__set_app_type
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__p__commode

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f9d68732669b5e16a71ed4a2008c106

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

debug

labdb

labfunc

labtest

comctl32

msvcr90

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 14KB - Virtual size: 14KB

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 14KB - Virtual size: 14KB