9112ee7b38523025f2d2ba92d488fd6541a6867849f5595305ab3a0d14c5edf8

Sharing

Copy URL Twitter E-mail

General

Target

9112ee7b38523025f2d2ba92d488fd6541a6867849f5595305ab3a0d14c5edf8
Size

776KB
MD5

043d9f7748b0814084c27250b2bfcf49
SHA1

fbe0efb72273d717128297db043bf6a3b6b7dcde
SHA256

9112ee7b38523025f2d2ba92d488fd6541a6867849f5595305ab3a0d14c5edf8
SHA512

cce359faa1239f02024cf3e457252b31a93850639a5bb1c0d180e93b94b39d29ad165870a5bcd7b0fa443edd1bcf66aac661e213f3c1a37bf077bf73964dd158
SSDEEP

12288:sQbgrtJYhV8QR/UB7v14t67nVut+XG1ykwM+hGxIgvMI:TbgYXR8Bx4t2VuUXG4fM+hGeKn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9112ee7b38523025f2d2ba92d488fd6541a6867849f5595305ab3a0d14c5edf8

Files

9112ee7b38523025f2d2ba92d488fd6541a6867849f5595305ab3a0d14c5edf8
.exe windows:6 windows x86 arch:x86

3f574318c9c9e0ba3a99d9a855d493df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\1\b\bin\win32\py.pdb

Imports

shell32

ShellExecuteExW
SHGetFolderPathW

api-ms-win-core-path-l1-1-0

PathCchCombineEx
PathCchRemoveFileSpec

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegCloseKey

kernel32

HeapSize
HeapReAlloc
WriteConsoleW
SetFilePointerEx
IsDebuggerPresent
GetStartupInfoW
ReadFile
SizeofResource
SetConsoleCtrlHandler
SetInformationJobObject
QueryInformationJobObject
SearchPathW
GetBinaryTypeW
GetCommandLineW
GetCurrentProcess
GetStdHandle
AssignProcessToJobObject
GetModuleFileNameW
CreateJobObjectW
CompareStringOrdinal
GetEnvironmentVariableW
CreateFileW
GetFileAttributesW
DuplicateHandle
MultiByteToWideChar
GetPrivateProfileStringW
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
LockResource
CloseHandle
CompareStringEx
FindResourceExW
LoadResource
GetCurrentDirectoryW
GetProcAddress
CreateProcessW
GetModuleHandleW
IsWow64Process
GetExitCodeProcess
GetFileSizeEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
DecodePointer
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap

Sections

.text
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 552KB - Virtual size: 551KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f574318c9c9e0ba3a99d9a855d493df

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

api-ms-win-core-path-l1-1-0

advapi32

kernel32

Sections

.text Size: 133KB - Virtual size: 132KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 552KB - Virtual size: 551KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 133KB - Virtual size: 132KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 552KB - Virtual size: 551KB

.reloc
Size: 6KB - Virtual size: 5KB