41846fe4759a806a6254f32083266780N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

41846fe4759a806a6254f32083266780N.exe
Size

228KB
MD5

41846fe4759a806a6254f32083266780
SHA1

a5dd941d59fc25f9eba8da1d358166ef180431a1
SHA256

c55b577eefb81a72023efe210b01ee926a5bb77a6ce5f525cf7645271d96e55c
SHA512

5e4c619106c0b4ae344842e1bfd0ee88549cb16fbf77c828519b2d77e44f0f42f9cd91e968e3ada731b771c3e7a4ee84ed686cca9ebb3b7b14ea89f7c1163e74
SSDEEP

6144:HomzOjOq3c5HS94oY+j4+6CIBLBcGkgmWs0:HomzRQcEY+j4+oLDW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41846fe4759a806a6254f32083266780N.exe

Files

41846fe4759a806a6254f32083266780N.exe
.exe windows:4 windows x86 arch:x86

88472e6e455e6270349ca4717d3bfc5e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetCurrentProcess
OpenProcess
GetPriorityClass
MultiByteToWideChar
LocalAlloc
lstrcmpiW
LocalFree
LoadLibraryA
GetProcAddress
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
SetWaitableTimer
FlushFileBuffers
SetStdHandle
LCMapStringW
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetStringTypeW
LCMapStringA
CreateWaitableTimerA
GetStringTypeA
GetOEMCP
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP

user32

GetDoubleClickTime
MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SetWindowLongA
MessageBoxA
wsprintfA
GetCursorPos
WindowFromPoint
ReleaseCapture
SetCapture
CallWindowProcA

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory

advapi32

LookupAccountSidW

oleaut32

VariantTimeToSystemTime

Sections

.text
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

88472e6e455e6270349ca4717d3bfc5e

Headers

File Characteristics

Imports

kernel32

user32

wtsapi32

advapi32

oleaut32

Sections

.text Size: 56KB - Virtual size: 54KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 144KB - Virtual size: 149KB

.rsrc Size: 20KB - Virtual size: 18KB

.text
Size: 56KB - Virtual size: 54KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 144KB - Virtual size: 149KB

.rsrc
Size: 20KB - Virtual size: 18KB