b7fd4002c98d3fdacac5e0c1c64a8250e9ff8db83d8d874c037728e524fd327a

Sharing

Copy URL

Twitter E-mail

General

Target

b7fd4002c98d3fdacac5e0c1c64a8250e9ff8db83d8d874c037728e524fd327a
Size

82KB
MD5

9fe237248706429647bf81442160d78e
SHA1

f8dd61e2e202fddff15bda6dbc71a8b44867e4e7
SHA256

b7fd4002c98d3fdacac5e0c1c64a8250e9ff8db83d8d874c037728e524fd327a
SHA512

98d94b63c8ab00595d0ee16b6c59800e178a6ce22f48dda555326615c2343f55c8e8bda03cda9ba4e3833506867f9aac5396c8853f3f2a6c6cb78767702ac58c
SSDEEP

1536:I7ZOh5ahyy8cT5ddpXHwTz885FWYMt8a/uRqqMWdvY7Cizc14eImErg+PPP:4Oh5agoTLdpXWbW8nDBdQeizc14ZmEjP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7fd4002c98d3fdacac5e0c1c64a8250e9ff8db83d8d874c037728e524fd327a

Files

b7fd4002c98d3fdacac5e0c1c64a8250e9ff8db83d8d874c037728e524fd327a
.exe windows:4 windows x86 arch:x86

1205ced16eae6ca19839ed4ebb9042ce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

U:\develop\global\src\heidi\bin\i386\Release\HPSETUP.pdb

Imports

hcreg9

?GetProductName@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ

mfc80u

ord2534
ord2832
ord2708
ord4301
ord2829
ord2725
ord2531
ord5562
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord2640
ord1007
ord3800
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord757
ord1079
ord870
ord577
ord2311
ord283
ord1198
ord293
ord1118
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord566
ord4535
ord3677
ord764
ord5096
ord2310

msvcr80

_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
__CxxFrameHandler3

kernel32

LoadLibraryW
Sleep
InterlockedCompareExchange
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InterlockedExchange

user32

MessageBoxW

oleaut32

SysFreeString

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1205ced16eae6ca19839ed4ebb9042ce

Headers

File Characteristics

PDB Paths

Imports

hcreg9

mfc80u

msvcr80

kernel32

user32

oleaut32

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 67KB - Virtual size: 68KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 67KB - Virtual size: 68KB