16992861b742088e9d44a9b47b23c4e90a588a8c28d153ca6d7bea7088e8e4f7

Sharing

Copy URL Twitter E-mail

General

Target

16992861b742088e9d44a9b47b23c4e90a588a8c28d153ca6d7bea7088e8e4f7
Size

112KB
MD5

f3c07fa96362078354a98054026892e8
SHA1

3c61b74513331fe6b10b04f0736f1cc1df598291
SHA256

16992861b742088e9d44a9b47b23c4e90a588a8c28d153ca6d7bea7088e8e4f7
SHA512

607e716bdec1f42bbfc5e65e7fae867c3945641f1b274c8a36bfa2a17f2bd29820de88cb6192436feab286195a03cd40f9f13e44c5d11190fc95c39c0315e303
SSDEEP

1536:Nkt6PkwLskGeo1FzYtohH+dKY0UIWF+v/x:NjPkw8D1FzYtob7v/x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16992861b742088e9d44a9b47b23c4e90a588a8c28d153ca6d7bea7088e8e4f7

Files

16992861b742088e9d44a9b47b23c4e90a588a8c28d153ca6d7bea7088e8e4f7
.exe windows:4 windows x86 arch:x86

6cefe233559eb5b5131ade3478c541ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CommandLineFromMsiDescriptor
RegCloseKey
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegGetValueW
RegQueryValueExA
RegSetValueExW

kernel32

CloseHandle
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateSemaphoreA
CreateToolhelp32Snapshot
DeleteFileW
EnumResourceNamesW
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FreeLibrary
FreeResource
GetBinaryTypeW
GetCommandLineW
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetLongPathNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetTempFileNameW
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
IsBadStringPtrW
LoadLibraryExW
LoadResource
LocalFree
LockResource
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
ReleaseSemaphore
SearchPathW
UnmapViewOfFile
WideCharToMultiByte
lstrcmpW
lstrcmpiW
wine_get_unix_file_name
wine_get_dos_file_name

ntdll

_vsnprintf
__wine_unix_spawnvp

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
PropVariantClear

shell32

SHGetFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

shlwapi

AssocQueryStringW
PathFindExtensionW
PathFindFileNameW
PathMatchSpecW
PathRemoveExtensionW
PathSkipRootW
SHCreateStreamOnFileW

ucrtbase

__acrt_iob_func
__p___argc
__p___wargv
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vswprintf
_configure_wide_argv
_get_initial_wide_environment
_initialize_wide_environment
_set_app_type
_strdup
_wcsicmp
_wcslwr
_wcsnicmp
_wfopen
_wgetenv
exit
fclose
feof
fgets
fputc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
realloc
strchr
strcmp
strcspn
strlen
wcschr
wcscmp
wcslen
wcsrchr
wcsstr
wcstok
wcstol

user32

CharLowerW
MsgWaitForMultipleObjects

windowscodecs

WICConvertBitmapSource

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 736B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6cefe233559eb5b5131ade3478c541ab

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ole32

shell32

shlwapi

ucrtbase

user32

windowscodecs

Sections

.text Size: 48KB - Virtual size: 46KB

.data Size: 4KB - Virtual size: 76B

.rdata Size: 48KB - Virtual size: 44KB

.bss Size: - Virtual size: 736B

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 48KB - Virtual size: 46KB

.data
Size: 4KB - Virtual size: 76B

.rdata
Size: 48KB - Virtual size: 44KB

.bss
Size: - Virtual size: 736B

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB