SZ-PK09447296[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SZ-PK09447296.exe
Size

726KB
MD5

a0d00704e38a9d62d2352d512af22e6c
SHA1

3c98a6b520c0404e5b598e3f45382131087be1fc
SHA256

a369d124f0a2ae45bea53b4cb55a76a5e064b5a421c983d8c3100eb3fe0ae956
SHA512

41017bbf7650d198ac75fa9b0cd6112aa0411bb8c356779bad5b17ce323fae2261f54898dcc8d480f099ee4ec723eecc79d326e4b808f9735fea0ebd1f0aae97
SSDEEP

12288:+w8dxucyj1g/XrUsN+FdQ0y/GXjBb/Lc8xiQYn56efmOEvWJQTbRYLu:+wMxo1Ub8fQheFzMnMe+5vWexY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SZ-PK09447296.exe

Files

SZ-PK09447296.exe
.exe windows:6 windows x86 arch:x86

ee1826ef94fbf687bc75ea97090704b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\удача\Desktop\projects\Release\BigProject.pdb

Imports

kernel32

WaitForSingleObject
Sleep
GetCurrentProcess
CreateThread
VirtualAlloc
VirtualProtect
FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryA
MultiByteToWideChar
CloseHandle
HeapSize
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
CreateFileW
FindClose
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
WideCharToMultiByte
GetStringTypeW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
GetFileType
WriteConsoleW

user32

CreateWindowExW
DestroyWindow
ShowWindow
GetSystemMetrics
UpdateWindow
GetForegroundWindow
SetWindowTextW
GetWindowTextW
MessageBoxW
GetDesktopWindow
GetCursorPos
SetCursorPos

advapi32

OpenProcessToken

oleaut32

SysAllocString
SysReAllocString
SysFreeString
SysStringLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetElement
SafeArrayPutElement
VariantInit
VariantClear

userenv

ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock
CreateEnvironmentBlock
GetUserProfileDirectoryW
GetAllUsersProfileDirectoryW
GetDefaultUserProfileDirectoryW
DeleteProfileW
GetProfilesDirectoryW
RefreshPolicy

Sections

.text
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 357KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee1826ef94fbf687bc75ea97090704b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

oleaut32

userenv

Sections

.text Size: 284KB - Virtual size: 283KB

.rdata Size: 73KB - Virtual size: 73KB

.data Size: 357KB - Virtual size: 360KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 284KB - Virtual size: 283KB

.rdata
Size: 73KB - Virtual size: 73KB

.data
Size: 357KB - Virtual size: 360KB

.reloc
Size: 10KB - Virtual size: 10KB