27c8c2bb820eac4a542369c2d3b6743bf53742b7f39989ce004e92af20d975bb

Sharing

Copy URL Twitter E-mail

General

Target

27c8c2bb820eac4a542369c2d3b6743bf53742b7f39989ce004e92af20d975bb
Size

625KB
MD5

6c111749c7d55675b9c8cf58920bfadc
SHA1

0fca1dbdcfcf003e5b7ba171d92b18ea27ba3dba
SHA256

27c8c2bb820eac4a542369c2d3b6743bf53742b7f39989ce004e92af20d975bb
SHA512

3407e72950d19b4f6e1f8e6e6aaed6a63bcf8fe7798deb0d7c2c8af7458b527be900f6ee515bc8e3fbf368a14c9e7ab49bfc06853f5ab436a0f4893593e72405
SSDEEP

6144:/UEdZxRNd7kJYlUrX+Dur9wILyPPHBRoM3:/USZxRNd7kJYlUrX+DurWkKPHB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27c8c2bb820eac4a542369c2d3b6743bf53742b7f39989ce004e92af20d975bb

Files

27c8c2bb820eac4a542369c2d3b6743bf53742b7f39989ce004e92af20d975bb
.exe windows:5 windows x86 arch:x86

d3df15bdf07b79d036fe88701201c0d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAIoctl
connect
WSAStartup
select
htons
setsockopt
WSACleanup
recv
socket
closesocket
gethostbyname
send

kernel32

WriteConsoleW
SetStdHandle
GetStringTypeW
HeapReAlloc
MultiByteToWideChar
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
VirtualFree
VirtualAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
HeapCreate
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
Sleep
CreateEventA
GetLastError
CloseHandle
GetCurrentThreadId
LCMapStringW
WideCharToMultiByte
lstrlenW
InterlockedExchange
ResetEvent
CreateEventW
CancelIo
GetThreadContext
SetThreadContext
OpenProcess
GetFileAttributesA
GetExitCodeProcess
CreateProcessA
GetSystemDirectoryA
VirtualAllocEx
ResumeThread
MoveFileExA
SetErrorMode
GetTickCount
GetConsoleWindow
Process32FirstW
GetModuleFileNameA
Process32NextW
GetCurrentDirectoryA
CreateToolhelp32Snapshot
GetUserDefaultUILanguage
CreateFileW
GetTickCount64
QueryPerformanceCounter
GetStartupInfoW
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
FlushFileBuffers
SetLastError
CreateThread
HeapSize
ExitThread
DecodePointer
EncodePointer
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineW
HeapSetInformation
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

user32

ShowWindow
PostThreadMessageA
GetInputState

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyW
RegQueryValueExW

winmm

timeGetTime

Sections

.text
Size: 534KB - Virtual size: 533KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3df15bdf07b79d036fe88701201c0d2

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

winmm

Sections

.text Size: 534KB - Virtual size: 533KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 7KB - Virtual size: 22KB

.rsrc Size: 50KB - Virtual size: 50KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 534KB - Virtual size: 533KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 7KB - Virtual size: 22KB

.rsrc
Size: 50KB - Virtual size: 50KB

.reloc
Size: 10KB - Virtual size: 10KB