9dd9ab6730d8b01bf43930690f591277504cb39c7261ecb819b77a713a380f00

Sharing

Copy URL Twitter E-mail

General

Target

9dd9ab6730d8b01bf43930690f591277504cb39c7261ecb819b77a713a380f00
Size

485KB
MD5

992072fe43c314440823d792d8fe93a6
SHA1

a9a14f4942c9c176d165ea7539bb6e6de03ddc07
SHA256

9dd9ab6730d8b01bf43930690f591277504cb39c7261ecb819b77a713a380f00
SHA512

cfea0e8d54622752c378443df76382bbf4239bdb0fdd452f69575c222f38c6bbae9d9a00591af470b265e2b1b0078c117515d6cb6d2a5f6820635266c701ee6e
SSDEEP

12288:wYRtieae3FZUta7wT4WP/MrmgOE+ikAafNGM:9paUFZvwTvUrBOEiAYNGM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9dd9ab6730d8b01bf43930690f591277504cb39c7261ecb819b77a713a380f00

Files

9dd9ab6730d8b01bf43930690f591277504cb39c7261ecb819b77a713a380f00
.exe windows:5 windows x86 arch:x86

efa3477900268cf80215603c1ee46c1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateJobObjectW
SleepEx
GetModuleHandleW
GetTickCount
GetConsoleAliasesA
GlobalAlloc
SetVolumeMountPointA
lstrcpynW
GetModuleFileNameW
SetConsoleTitleA
ReleaseActCtx
SetLastError
GetProcAddress
BuildCommDCBW
GetAtomNameA
LoadLibraryA
WriteConsoleA
UnhandledExceptionFilter
InterlockedExchangeAdd
SetFileApisToANSI
AddAtomA
OpenJobObjectW
FoldStringW
lstrcatW
EnumDateFormatsW
FindFirstVolumeA
LocalFree
GetLastError
HeapFree
MultiByteToWideChar
HeapAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

winhttp

WinHttpAddRequestHeaders

Sections

.text
Size: 414KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 34.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cic
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

efa3477900268cf80215603c1ee46c1e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winhttp

Sections

.text Size: 414KB - Virtual size: 413KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 7KB - Virtual size: 34.9MB

.cic Size: 1024B - Virtual size: 1024B

.rsrc Size: 55KB - Virtual size: 54KB

.text
Size: 414KB - Virtual size: 413KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 7KB - Virtual size: 34.9MB

.cic
Size: 1024B - Virtual size: 1024B

.rsrc
Size: 55KB - Virtual size: 54KB