18fcba224857d5ed06f020a170a8d980N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

18fcba224857d5ed06f020a170a8d980N.exe
Size

533KB
MD5

18fcba224857d5ed06f020a170a8d980
SHA1

de314afbb2d8a7e81a8f3ac847501535ceb350af
SHA256

ff7b72d94344e3fb4e4d6cd39510468ba53b4815a03520431a8d9996aa4ed0b4
SHA512

161374b754297772b4577001a4b4dc09673da5cb58ca361fb98164470d63372b29bdeda6b6b142fe67b74a3cd54c6413d8b75ac4888c9a94c12f5034aacc6afe
SSDEEP

6144:lYENTTI6lsgJnW1VCEWdr4MMwKwifOV3ZVmEmNK3JHsnfx/EjK/mvmPF+jhyNGAJ:6ENnqLfW9BB3e7NHTk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18fcba224857d5ed06f020a170a8d980N.exe

Files

18fcba224857d5ed06f020a170a8d980N.exe
.exe windows:5 windows x64 arch:x64

dd82a31ec5fa3dd562d7a73279b43464

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

EnumSystemLocalesA
GetLocaleInfoA
VirtualAlloc
GetFileAttributesW
GetCommandLineW
GetStartupInfoW
RaiseException
RtlPcToFileHeader
HeapAlloc
GetLastError
HeapFree
DecodePointer
EncodePointer
RtlUnwindEx
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
Sleep
HeapSize
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetUserDefaultLCID
IsValidLocale

advapi32

RegCloseKey
RegOpenKeyExW

urlmon

URLOpenBlockingStreamW

crypt32

CertEnumSystemStore

Sections

.text
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd82a31ec5fa3dd562d7a73279b43464

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

urlmon

crypt32

Sections

.text Size: 90KB - Virtual size: 89KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 4KB - Virtual size: 9KB

.pdata Size: 6KB - Virtual size: 5KB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 402KB - Virtual size: 402KB

.text
Size: 90KB - Virtual size: 89KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 4KB - Virtual size: 9KB

.pdata
Size: 6KB - Virtual size: 5KB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 402KB - Virtual size: 402KB