0a4a99d1c3f7f111132e337ab60b5d30364f1f6caa4830ddeea337dc6f9d6841

Sharing

Copy URL

Twitter E-mail

General

Target

0a4a99d1c3f7f111132e337ab60b5d30364f1f6caa4830ddeea337dc6f9d6841
Size

4.9MB
MD5

e9a436e3b5e8e0e418a5160d22bb5c59
SHA1

79c2651b747d7585e101697886e69ea843a3c5ef
SHA256

0a4a99d1c3f7f111132e337ab60b5d30364f1f6caa4830ddeea337dc6f9d6841
SHA512

5bb77756ce158bd4f7cb61759d204ba6bb119fc1c589f3f579ece387d3ecf061079b93039271d9a1c8e6e1f6adfc35198173621d22f976d1861ea60ace51dae9
SSDEEP

98304:cDtKPvY1J/hPhtbhsLaRUsfQqG6SGDnw+YSKakx3/ek2lnULDNx3:q4Xi3NUsbBwnL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a4a99d1c3f7f111132e337ab60b5d30364f1f6caa4830ddeea337dc6f9d6841

Files

0a4a99d1c3f7f111132e337ab60b5d30364f1f6caa4830ddeea337dc6f9d6841
.exe windows:5 windows x86 arch:x86

cda8608b89c76bb6b6a7c8544ab67c00

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\newyunxiao\GZ-Support_pc\pcsafe_win_EProtect_CommitSvn\workspace\svn_dir\bin\EPStableData.pdb

Imports

kernel32

GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

netapi32

NetUserGetInfo

shlwapi

StrCmpIW

setupapi

SetupDiGetDeviceInstanceIdW

version

VerQueryValueW

iphlpapi

GetIpAddrTable

ws2_32

gethostname

user32

wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetDeviceCaps

advapi32

RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CoCreateInstance

oleaut32

SysStringLen

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 455KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ep0
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ep1
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 869B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cda8608b89c76bb6b6a7c8544ab67c00

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

netapi32

shlwapi

setupapi

version

iphlpapi

ws2_32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wtsapi32

Sections

.text Size: - Virtual size: 1.7MB

.rdata Size: - Virtual size: 455KB

.data Size: - Virtual size: 29KB

.ep0 Size: - Virtual size: 2.3MB

.ep1 Size: 4.9MB - Virtual size: 4.9MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 869B

.text
Size: - Virtual size: 1.7MB

.rdata
Size: - Virtual size: 455KB

.data
Size: - Virtual size: 29KB

.ep0
Size: - Virtual size: 2.3MB

.ep1
Size: 4.9MB - Virtual size: 4.9MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 869B