24e6a9244b7b41973fcc477989f8a933ffaefd16043d0470d35ad1cfaf5b347e

Sharing

Copy URL Twitter E-mail

General

Target

24e6a9244b7b41973fcc477989f8a933ffaefd16043d0470d35ad1cfaf5b347e
Size

6.4MB
MD5

151374be4dd2600f9618f1979e0caf95
SHA1

d02281ed1500a20a67bb7a1c8839f42d7353db18
SHA256

24e6a9244b7b41973fcc477989f8a933ffaefd16043d0470d35ad1cfaf5b347e
SHA512

6f6adbb8c8a69180caf260ab01d50f6c054244a99ef60f2ce021c164c5ccee05fb5130fca6e18e3bf31de2e4c887676c86bcb943ccd553f565c9abc2ecea6409
SSDEEP

196608:npdPZxSuYgy42sB+H4y5QcHCVooif5J6Iqf/thHy+hJmKEyZjS2OY606ZyEjzYLd:pUuYgyScHCqJAxgyFS2OcLDpNdD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24e6a9244b7b41973fcc477989f8a933ffaefd16043d0470d35ad1cfaf5b347e

Files

24e6a9244b7b41973fcc477989f8a933ffaefd16043d0470d35ad1cfaf5b347e
.exe windows:6 windows x86 arch:x86

78f65570fe9ca9cd6735802b1f94a69d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
ReadConsoleW
LoadLibraryExW
LoadLibraryA
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
GetSystemTimeAsFileTime
DeleteFileW
FindClose
FreeLibrary
GetSystemDirectoryA
FormatMessageA
GetFileSize
GetConsoleOutputCP
SetLastError
IsValidCodePage
GetProcAddress
ReadFile
GetConsoleMode
GetCPInfo
HeapSize
GetLastError
GetStdHandle
PeekNamedPipe
GetCurrentDirectoryW
RtlUnwind
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetFileSizeEx
DecodePointer
GetModuleHandleW
GetTimeZoneInformation
SetEndOfFile
FileTimeToSystemTime
CompareStringW
GetOEMCP
HeapFree
InitializeCriticalSection
WideCharToMultiByte
GetFullPathNameW
UnhandledExceptionFilter
GetVersionExA
GetCurrentThreadId
MoveFileExA
GetFileType
WriteFile
GetStringTypeW
GetFileAttributesExW
CreateThread
SetEnvironmentVariableW
CreateFileA
FindNextFileW
TlsAlloc
EncodePointer
QueryPerformanceCounter
GetFileInformationByHandle
CloseHandle
FindFirstFileExW
GetTickCount
RaiseException
GetEnvironmentStringsW
GetStartupInfoW
GetCurrentProcessId
TlsSetValue
GetModuleFileNameW
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
WaitForMultipleObjects
SetStdHandle
GetACP
FreeLibraryAndExitThread
WaitForSingleObject
LeaveCriticalSection
GetCurrentProcess
LCMapStringW
GetEnvironmentVariableA
GetCommandLineW
QueryPerformanceFrequency
HeapAlloc
TlsGetValue
TerminateProcess
HeapReAlloc
ExitThread
SleepEx
FreeEnvironmentStringsW
TlsFree
GetModuleHandleExW
InitializeSListHead
GetModuleHandleA
DeleteCriticalSection
SetUnhandledExceptionFilter
Sleep
GetProcessHeap
MoveFileExW
GetCommandLineA
CreateFileW

user32

LoadIconW
PostMessageW
EndPaint
TranslateMessage
ShowWindow
DrawTextW
GetWindowRect
RegisterClassExW
GetClientRect
DefWindowProcW
GetMessageW
UpdateWindow
BeginPaint
RedrawWindow
PostQuitMessage
DispatchMessageW
FillRect
CreateWindowExW
MessageBoxW
SetWindowPos
GetSystemMetrics

gdi32

CreateSolidBrush
SetTextColor
DeleteObject
SetBkMode

advapi32

CryptGetHashParam
CryptDestroyHash
CryptEncrypt
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptHashData
RegEnumKeyExA
CryptCreateHash
CryptDestroyKey
CryptImportKey

crypt32

PFXImportCertStore
CertFreeCertificateChainEngine
CertFindCertificateInStore
CertFreeCertificateContext
CertFindExtension
CertOpenStore
CryptQueryObject
CertEnumCertificatesInStore
CertGetCertificateChain
CertFreeCertificateChain
CryptDecodeObjectEx
CryptStringToBinaryA
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord45
ord60
ord22
ord211
ord50
ord143
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
listen
sendto
recvfrom
select
__WSAFDIsSet
gethostname
ntohl
ioctlsocket

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78f65570fe9ca9cd6735802b1f94a69d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 5.9MB - Virtual size: 5.9MB

.rdata Size: 137KB - Virtual size: 137KB

.data Size: 44KB - Virtual size: 58KB

.rsrc Size: 68KB - Virtual size: 67KB

.reloc Size: 75KB - Virtual size: 74KB

.text
Size: 5.9MB - Virtual size: 5.9MB

.rdata
Size: 137KB - Virtual size: 137KB

.data
Size: 44KB - Virtual size: 58KB

.rsrc
Size: 68KB - Virtual size: 67KB

.reloc
Size: 75KB - Virtual size: 74KB