11d630040719dfb1fb93044d2bc31b4048cbece6b64be5fd9743d637da52c461

Sharing

Copy URL

Twitter E-mail

General

Target

11d630040719dfb1fb93044d2bc31b4048cbece6b64be5fd9743d637da52c461
Size

1.3MB
MD5

622e777f04ae4f60412f1426a9dfde79
SHA1

4d02431e6f66994c5d073666b01f92d0d6fd1b1b
SHA256

11d630040719dfb1fb93044d2bc31b4048cbece6b64be5fd9743d637da52c461
SHA512

12b7dbc56398f4824a61178ceae55411381bff292dad54c2c63c133262c13c7ed135baaaefad6247b01d77c721d3e8d6f50455484106a14f69f2ed00fdc88165
SSDEEP

24576:6QH3R5cWDePtVpAOdkitT8tzQvE3ly3323eFTD1:VcdIOevcp2UTZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11d630040719dfb1fb93044d2bc31b4048cbece6b64be5fd9743d637da52c461

Files

11d630040719dfb1fb93044d2bc31b4048cbece6b64be5fd9743d637da52c461
.exe windows:4 windows x86 arch:x86

9caa52cbe2fc11312690dc53002bd5a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegReplaceKeyW
RegRestoreKeyW
RegSaveKeyW
RegSetValueExW
RegUnLoadKeyW

kernel32

CloseHandle
CompareStringW
CopyFileW
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
EnumCalendarInfoW
EnumSystemLocalesW
ExitProcess
ExitThread
FindClose
FindFirstFileW
FormatMessageW
FreeLibrary
GetACP
GetCPInfo
GetCPInfoExW
GetCommandLineA
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceW
GetEnvironmentStrings
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetSystemInfo
GetThreadLocale
GetThreadPriority
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultUILanguage
GetVersion
GetVersionExA
GetVersionExW
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
IsDebuggerPresent
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LocalAlloc
LocalFree
MapViewOfFile
MultiByteToWideChar
OpenFileMappingA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
SetThreadPriority
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrlenW

netapi32

NetApiBufferFree
NetWkstaGetInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shfolder

SHGetFolderPathA

user32

CharLowerBuffW
CharNextW
CharUpperBuffW
CharUpperW
EnumThreadWindows
GetSystemMetrics
LoadStringW
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
wsprintfA

ole32

CoInitialize
CoUninitialize

oleaut32

GetErrorInfo
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit

Exports

Exports

@@Licapi@Finalize
@@Licapi@Initialize
TMethodImplementationIntercept
__GetExceptDLLinfo
___CPPdebugHook
dbkFCallWrapperAddr

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9caa52cbe2fc11312690dc53002bd5a9

Headers

File Characteristics

Imports

advapi32

kernel32

netapi32

version

shfolder

user32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.data Size: 43KB - Virtual size: 112KB

.tls Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 8KB

.didata Size: 512B - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 19KB - Virtual size: 20KB

.reloc Size: 100KB - Virtual size: 104KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 43KB - Virtual size: 112KB

.tls
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 8KB

.didata
Size: 512B - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 19KB - Virtual size: 20KB

.reloc
Size: 100KB - Virtual size: 104KB