5739cc6d93604ca8f33b76f5971893b09fac8264799b4a7b0dfa8b32413da3e8

Sharing

Copy URL Twitter E-mail

General

Target

5739cc6d93604ca8f33b76f5971893b09fac8264799b4a7b0dfa8b32413da3e8
Size

235KB
MD5

790fed238de50ad9030b8a61a3390d1f
SHA1

bed12f6cb1fa67f965c112a882302c998d63a91c
SHA256

5739cc6d93604ca8f33b76f5971893b09fac8264799b4a7b0dfa8b32413da3e8
SHA512

32bc6e077d1e38eb972b94cdc6b79fccac8bb2996266bb7c11adde6e08341c5bb29dd4a4d8b07cfd2e1fac05744acb7965909021ffac5303e0fca4fcf5961350
SSDEEP

6144:MfaC3SvYMk3SvYMk3SvYMtbn2QrHjsnU/zC51L:M/3SvYMk3SvYMk3SvYMFncU/2TL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5739cc6d93604ca8f33b76f5971893b09fac8264799b4a7b0dfa8b32413da3e8

Files

5739cc6d93604ca8f33b76f5971893b09fac8264799b4a7b0dfa8b32413da3e8
.exe windows:5 windows x86 arch:x86

cb18727ce8f4d35278cbf1cec7b0ab6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteW
SHFileOperationW
SHGetPathFromIDListW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetFileInfoW

ole32

OleInitialize
CoTaskMemFree
OleUninitialize
CoCreateInstance

advapi32

RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
RegCreateKeyExW

gdi32

SelectObject
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
SetBkMode
SetTextColor

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

LCMapStringW
GetStringTypeW
GetStringTypeA
GlobalUnfix
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
CreateTimerQueue
GetTapeStatus
LocalUnlock
GetThreadContext
CheckRemoteDebuggerPresent
SetEndOfFile
GetProcessIoCounters
GetProcessId
ClearCommBreak
ReleaseMutex
GetVersion
SetSystemTimeAdjustment
GetThreadIOPendingFlag
EncodeSystemPointer
AssignProcessToJobObject
GetFileTime
CreateFileMappingW
UpdateResourceW
SetSystemPowerState
OpenProcess
GetCurrentProcess
GlobalDeleteAtom
GetCurrentThreadId
CreateNamedPipeW
GetCommandLineA
FreeResource
PostQueuedCompletionStatus
SetProcessWorkingSetSize
SetHandleInformation
FlushFileBuffers
AreFileApisANSI
ConvertThreadToFiber
TlsSetValue
CreateFiberEx
GetProcessHandleCount
CancelWaitableTimer
GetProcessAffinityMask
GetModuleFileNameA
IsSystemResumeAutomatic
FlushInstructionCache
InitAtomTable
GetProcessVersion
CancelIo
DeleteAtom
SetFilePointerEx
GetCommTimeouts
DecodeSystemPointer
SetFileApisToOEM
ReplaceFileA
FlushViewOfFile
GetPriorityClass
IsWow64Process
GetCurrentThread
SetStdHandle
DecodePointer
GetFileSize
MulDiv
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 53KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data
.rdata
.rsrc/0/JPEG/62
.jpg
.rsrc/0/version.txt
.rsrc/1033/DIALOG/105
.rsrc/1033/DIALOG/106
.rsrc/1033/DIALOG/111
.rsrc/1033/DIALOG/205
.rsrc/1033/DIALOG/206
.rsrc/1033/DIALOG/211
.rsrc/1033/DIALOG/305
.rsrc/1033/DIALOG/306
.rsrc/1033/DIALOG/311
.rsrc/1033/DIALOG/405
.rsrc/1033/DIALOG/406
.rsrc/1033/DIALOG/411
.rsrc/1033/DIALOG/505
.rsrc/1033/DIALOG/506
.rsrc/1033/DIALOG/511
.rsrc/1033/GROUP_ICON/103
.rsrc/1033/ICON/1.ico
.rsrc/1033/ICON/2.ico
.rsrc/1033/ICON/3.ico
.rsrc/1033/ICON/4.ico
.rsrc/1033/ICON/5.ico
.rsrc/1033/ICON/6.ico
.rsrc/1033/MANIFEST/1
.xml
.rsrc_1
.text

Sharing

General

Malware Config

Signatures

Files

cb18727ce8f4d35278cbf1cec7b0ab6b

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ole32

advapi32

gdi32

comctl32

version

kernel32

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 53KB - Virtual size: 1.2MB

.rsrc Size: 128KB - Virtual size: 128KB

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 53KB - Virtual size: 1.2MB

.rsrc
Size: 128KB - Virtual size: 128KB