0fef0fe689f2bd7820f26ac0b6237dd33406ba595333c6a8d5358be3afe1c85a

Sharing

Copy URL

Twitter E-mail

General

Target

0fef0fe689f2bd7820f26ac0b6237dd33406ba595333c6a8d5358be3afe1c85a
Size

3.5MB
MD5

71e2a096523b5207a2a84502b9ab80f7
SHA1

097718e776342ac7745fc0bb1fc69ca649fce257
SHA256

0fef0fe689f2bd7820f26ac0b6237dd33406ba595333c6a8d5358be3afe1c85a
SHA512

21122a36189300b513f99a87305e583a58ecdaa356d205e4539f9561e7ce19a9b5fbbb914380bba39a37ecccdb34df8cf745718c205587549f03c012aff746b6
SSDEEP

49152:InIVKknSD9bsFVWFuv5vaLgqaLPDu00HpCR3FhbDd8tqdfftgD/DAeLyqCZo4Jwa:5VKYSD+FVBv3tHujaPbxRdff4cucL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fef0fe689f2bd7820f26ac0b6237dd33406ba595333c6a8d5358be3afe1c85a

Files

0fef0fe689f2bd7820f26ac0b6237dd33406ba595333c6a8d5358be3afe1c85a
.exe windows:4 windows x86 arch:x86

154315be36b873b41deba711267a352e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
GetErrorInfo
SafeArrayPtrOfIndex

advapi32

RegQueryValueExA
SetSecurityDescriptorDacl

user32

GetKeyboardType
CreateWindowExW
MessageBoxTimeoutA

kernel32

GetACP
TlsSetValue
lstrlenW
Sleep
GetVersionExA
GetConsoleWindow
RtlUnwind
MulDiv
TryAcquireSRWLockExclusive

gdi32

UnrealizeObject

version

VerQueryValueW

ole32

CLSIDFromString
CoTaskMemFree

wsock32

WSACleanup

shell32

ShellExecuteExA
SHGetPathFromIDListA

wininet

HttpSendRequestExA

comctl32

_TrackMouseEvent

comdlg32

PrintDlgA

ws2_32

WSACloseEvent

psapi

GetProcessImageFileNameA

msvcrt

_onexit

iphlpapi

GetInterfaceInfo

Exports

Exports

madTraceProcess

Sections

.text
Size: 2.1MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bluem2
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bluem2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

154315be36b873b41deba711267a352e

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

version

ole32

wsock32

shell32

wininet

comctl32

comdlg32

ws2_32

psapi

msvcrt

iphlpapi

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 4.9MB

.bluem2 Size: 1.4MB - Virtual size: 1.4MB

.idata Size: 2KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 4KB

.bluem2 Size: 4KB - Virtual size: 4KB

.text
Size: 2.1MB - Virtual size: 4.9MB

.bluem2
Size: 1.4MB - Virtual size: 1.4MB

.idata
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 4KB

.bluem2
Size: 4KB - Virtual size: 4KB