3636b97853fe65a2cb9a93c9b0da0a4f304d30ce2cc2c796138f29ab954461ea

Sharing

Copy URL Twitter E-mail

General

Target

3636b97853fe65a2cb9a93c9b0da0a4f304d30ce2cc2c796138f29ab954461ea
Size

1.4MB
MD5

d3d1baa8b6cdd52c93a21423151efd15
SHA1

979fc799db93a55b94e5715c62360c8b87e181ff
SHA256

3636b97853fe65a2cb9a93c9b0da0a4f304d30ce2cc2c796138f29ab954461ea
SHA512

4a00cc6177cf5067ead5880014cb23f2d768dea90df5ae7aa433a1a974b472e73c243a693a1977643782b02bcd9dd8fb5ee399c99f63ac34194e8f9daba1cede
SSDEEP

12288:qH6oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:q52JOt934J7Z6bQaj1BvUm9J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3636b97853fe65a2cb9a93c9b0da0a4f304d30ce2cc2c796138f29ab954461ea

Files

3636b97853fe65a2cb9a93c9b0da0a4f304d30ce2cc2c796138f29ab954461ea
.exe windows:5 windows x86 arch:x86

9d008fddfe7aba04b6be2a65be7e15b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mspdbsrv.pdb

Imports

msvcr80

_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
_purecall
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
strncpy_s
malloc
_wpgmptr
memcpy_s
sprintf_s
exit
_snwprintf_s
_wdupenv_s
fclose
_wfopen_s
iswspace
memmove
_wcsicmp
wcstoul
wcschr
free
_wcsdup
_time64
_wctime64
__iob_func
fwprintf
vfwprintf
fflush
wcsncpy_s
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
memset
_crt_debugger_hook

advapi32

RegCloseKey
RegOpenKeyExA
GetTokenInformation
OpenProcessToken
RegQueryValueExA

kernel32

InterlockedCompareExchange
Sleep
InterlockedExchange
OpenProcess
QueryPerformanceCounter
GetCurrentThread
GetThreadTimes
QueryPerformanceFrequency
SetUnhandledExceptionFilter
SetErrorMode
VirtualQuery
GetModuleFileNameW
OpenEventW
SetPriorityClass
CreateMutexW
CreateEventW
CreateWaitableTimerA
CreateEventA
CreateMutexA
DuplicateHandle
GetCurrentThreadId
GetTickCount
WaitForSingleObject
SetEvent
ReleaseMutex
UnmapViewOfFile
SetWaitableTimer
CancelWaitableTimer
GetCurrentProcess
CreateFileMappingA
MapViewOfFile
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetCommandLineW
CloseHandle
GetLastError
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetVersion
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
CreateProcessA

rpcrt4

RpcBindingInqAuthClientA
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf2
RpcServerUseProtseqEpW
RpcMgmtStatsVectorFree
RpcMgmtInqStats
NdrServerCall2
NdrClientCall2

mspdbcore

?SetErrorHandlerAPI@PDB@@SAHP6APAUIPDBError@@PAU1@@Z@Z
?CloseAllTimeoutPDB@PDB@@SAHXZ
?OpenValidate4@PDB@@SAHPBGPBDPBU_GUID@@KKPAJPAGIPAPAU1@@Z
?OpenEx2W@PDB@@SAHPBGPBDJPAJPAGIPAPAU1@@Z
?FOpen@MREngine@@SGHPAPAU1@PAUPDB@@PAUNameMap@@HH@Z
?FOpen@MREngine@@SGHPAPAU1@PAUMreToPdb@@HH@Z
?FOpenW@MREngine@@SGHPAPAU1@PBGAAJPAGIHH@Z
?open@NameMap@@SAHPAUPDB@@HPAPAU1@@Z
?ShutDownTimeoutManager@PDB@@SAHXZ
?SetPDBCloseTimeout@PDB@@SAH_K@Z

secur32

GetUserNameExW

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9d008fddfe7aba04b6be2a65be7e15b7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

advapi32

kernel32

rpcrt4

mspdbcore

secur32

Sections

.text Size: 99KB - Virtual size: 98KB

.data Size: 1KB - Virtual size: 19KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 99KB - Virtual size: 98KB

.data
Size: 1KB - Virtual size: 19KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB