6e4e3027ef917c7b7911d01f3573ecdbcccdc6c320949c34a981056c75f208ba

Sharing

Copy URL Twitter E-mail

General

Target

6e4e3027ef917c7b7911d01f3573ecdbcccdc6c320949c34a981056c75f208ba
Size

135KB
MD5

1e0de5af2bd7aa2b5db5cc0d5c7cb6f8
SHA1

846212a17b2d0edb4914775a3fc3c2c3732ae548
SHA256

6e4e3027ef917c7b7911d01f3573ecdbcccdc6c320949c34a981056c75f208ba
SHA512

fd94748931e65808da0c47f9175ff77e9b80055c6cc18e54634488c5ecfd990683bea5245e18413059c02bea47af9ea9cf88d18cf51ef0afe777e8cc4794e206
SSDEEP

1536:gI3u1hyrAvEwQef3iqfbJMOw2chpajLxEA:ggu1hBvZhviMbJXZnK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e4e3027ef917c7b7911d01f3573ecdbcccdc6c320949c34a981056c75f208ba

Files

6e4e3027ef917c7b7911d01f3573ecdbcccdc6c320949c34a981056c75f208ba
.exe windows:6 windows x86 arch:x86

7e149bfa2d99da403c640fb923223ccc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeResource
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadResource
SizeofResource
LoadLibraryA
GlobalAlloc
GlobalUnlock
GlobalLock
lstrcmpA
lstrcpyA
lstrcatA
FindResourceA
CopyFileA
MultiByteToWideChar
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
IsDebuggerPresent
GetLastError
CloseHandle
Beep
GetWindowsDirectoryA
GetTickCount64
GetCurrentProcess
Sleep
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
WriteFile
CreateFileW
InitializeSListHead

user32

GetMessageA
LoadCursorA
GetWindowDC
TranslateMessage
DispatchMessageA
LoadIconA
BeginPaint
RegisterClassExA
CreateWindowExA
ShowWindow
ShowWindowAsync
SetWindowPos
GetSystemMetrics
DrawIcon
UpdateWindow
GetDC
ReleaseDC
EndPaint
PostQuitMessage
GetDesktopWindow
DefWindowProcA

gdi32

SetDIBColorTable
GetDIBColorTable
CreateDIBSection
SetStretchBltMode
StretchBlt
SelectObject
PlgBlt
InvertRgn
DeleteObject
DeleteDC
CreateSolidBrush
CreateEllipticRgn
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetObjectA

advapi32

RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW

shell32

SHChangeNotify

ole32

CreateStreamOnHGlobal

shlwapi

SHDeleteKeyA

gdiplus

GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc

msimg32

AlphaBlend
TransparentBlt

msvcp140

_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit

vcruntime140

__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__current_exception_context
__current_exception
_except_handler4_common
memset
memcpy
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_initterm_e
terminate
_c_exit
_resetstkoflw
_register_thread_local_exe_atexit_callback
exit
_errno
_controlfp_s
_exit
_invalid_parameter_noinfo
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_get_narrow_winmain_command_line
_initterm

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
free

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr
_libm_sse2_tan_precise
_libm_sse2_pow_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e149bfa2d99da403c640fb923223ccc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

gdiplus

msimg32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 106KB - Virtual size: 106KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 106KB - Virtual size: 106KB

.reloc
Size: 2KB - Virtual size: 1KB