6d0c5c181038f283c0ec8e194e7961e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6d0c5c181038f283c0ec8e194e7961e0N.exe
Size

5.0MB
MD5

6d0c5c181038f283c0ec8e194e7961e0
SHA1

8bc71c7aece020dd1be526bc68a84a81a69654bf
SHA256

1572745cd67a182aaa7ae032783e95ee6a5979b903807a076bf0d702297da7d5
SHA512

ecab47215e86dddfb8da66b4514f4b3880c3c18e2278485661ecd1a6b464a08f9980c9bc5cb4f75236d09835a0ab19c1a1741b5b11150f33f6e94a05cc395de4
SSDEEP

98304:rF3+UKNiTGzfho0taXbvnfiBgGD8LII09rUsFQ11J8K74+KY+ANXqXBgcQmOMEaF:R+wGzf/7/8rL+OXqX6jPb36n/s4bDbmd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d0c5c181038f283c0ec8e194e7961e0N.exe

Files

6d0c5c181038f283c0ec8e194e7961e0N.exe
.exe windows:4 windows x86 arch:x86

40c39a4c3bb35a33640792ff11ef6e82

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WaitForSingleObject
HeapDestroy
GetStringTypeW
LCMapStringA
HeapAlloc
LCMapStringW
ReadFile
GetVersionExA
GetCurrentProcess
MoveFileExA
SetHandleCount
FlushFileBuffers
GetLocalTime
Sleep
WaitForMultipleObjects
GetACP
GetCommandLineA
GetProcAddress
GetDriveTypeA
GetStringTypeA
InterlockedDecrement
TlsSetValue
LoadLibraryA
DeleteCriticalSection
GetModuleHandleA
HeapReAlloc
GetCPInfo
GetFullPathNameA
GetFileType
GetStartupInfoA
GetCurrentProcessId
GetCurrentThreadId
SetFilePointer
WriteFile
CreateThread
GetFileSize
ExitThread
GetOEMCP
MultiByteToWideChar
GetProcessHeap
WideCharToMultiByte
GetEnvironmentVariableA
GetModuleFileNameW
GetEnvironmentStrings
SleepEx
EnterCriticalSection
RtlUnwind
FreeLibrary
InterlockedIncrement
HeapCreate
GetModuleFileNameA
SetEndOfFile
GetCommandLineW
GetTickCount
FindFirstFileA
FileTimeToSystemTime
MoveFileW
TlsGetValue
InitializeCriticalSection
SetStdHandle
GetFileInformationByHandle
GetEnvironmentStringsW
GetModuleHandleW
UnhandledExceptionFilter
CompareStringA
TerminateProcess
GetFileAttributesA
SetLastError
QueryPerformanceCounter
SetEnvironmentVariableA
QueryPerformanceFrequency
GetVersion
FindClose
LeaveCriticalSection
GetCurrentThread
GetLastError
HeapFree
CreateFileA
GetTimeZoneInformation
FileTimeToLocalFileTime
GetCurrentDirectoryA
TlsAlloc
VirtualAlloc
CompareStringW
FreeEnvironmentStringsA
GetFileSizeEx
DeleteFileA
GetStartupInfoW
ExitProcess
VirtualFree
GetStdHandle
PeekNamedPipe
GetSystemDirectoryA
FreeEnvironmentStringsW
GetSystemTime
FormatMessageA

user32

UpdateWindow
BeginPaint
CreateWindowExW
MessageBoxA
RegisterClassExW
EndPaint
ShowWindow
RedrawWindow
GetMessageW
LoadIconW
DefWindowProcW
PostMessageW
GetWindowRect
DispatchMessageW
FillRect
PostQuitMessage
SendMessageA
TranslateMessage
SetWindowPos
GetClientRect
DrawTextW
GetSystemMetrics

gdi32

SetBkMode
SetTextColor
DeleteObject
CreateSolidBrush

advapi32

CryptEncrypt
CryptHashData
CryptGenRandom
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
CloseServiceHandle
CryptImportKey
CryptAcquireContextA

crypt32

CertFindExtension
CertGetCertificateChain
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CertFindCertificateInStore
CertCloseStore
CertEnumCertificatesInStore
CertOpenStore
CryptDecodeObjectEx
CertCreateCertificateChainEngine
CertFreeCertificateChain
CertFreeCertificateChainEngine
CryptQueryObject
CertAddCertificateContextToStore

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord45
ord60
ord22
ord211
ord26
ord143
ord50
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohl
listen

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40c39a4c3bb35a33640792ff11ef6e82

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 204KB - Virtual size: 201KB

.data Size: 56KB - Virtual size: 75KB

.rsrc Size: 72KB - Virtual size: 68KB

.reloc Size: 52KB - Virtual size: 48KB

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 204KB - Virtual size: 201KB

.data
Size: 56KB - Virtual size: 75KB

.rsrc
Size: 72KB - Virtual size: 68KB

.reloc
Size: 52KB - Virtual size: 48KB