fecd2ed0ba23e2019101929a882cc52b1c3cc044823b1e4280af85ccae2b7a75

General

Target

fecd2ed0ba23e2019101929a882cc52b1c3cc044823b1e4280af85ccae2b7a75
Size

2.7MB
MD5

9aaf9ace43e05956e0cdf3ac12834e82
SHA1

886009b5159a1bf591908fdddd4751aa223342df
SHA256

fecd2ed0ba23e2019101929a882cc52b1c3cc044823b1e4280af85ccae2b7a75
SHA512

6d94bd2769cac68e91f19ea2bdb40619d61d9f967c7e2c8dc5616b051f679f88c108e6b118a7c788c745d72d3dd1c6f66d967f32098c9ed87489149f26348cb3
SSDEEP

49152:BJG5aqSdxEQigU9intn4dAZk/tZrabpfZLeaK/IR1yvxWDtMMGYo5jm:BJGsqUEQiEn4EIXebpfZLeLIfIm+m1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fecd2ed0ba23e2019101929a882cc52b1c3cc044823b1e4280af85ccae2b7a75

Files

fecd2ed0ba23e2019101929a882cc52b1c3cc044823b1e4280af85ccae2b7a75
.exe windows:5 windows x86 arch:x86

8cd5a0c4b03c3777190af5aaacdc95a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction036
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

kernel32

ExitProcess
LocalFree
GetCommandLineW
FindResourceW
LoadResource
SizeofResource
LockResource
lstrcmpiW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
LoadLibraryExW
GetProcAddress
lstrlenW
WideCharToMultiByte
GetProcessHeap
HeapAlloc
SetFilePointer
CloseHandle
WriteFile
ReadFile
MultiByteToWideChar
CreateFileW
HeapFree
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesW
CreateProcessW
WaitForSingleObject
GetLastError
GetFileAttributesW
GetExitCodeProcess
EnumResourceNamesW
DeleteFileW
RemoveDirectoryW
GetVolumePathNameW
GetVolumeInformationW
GetCurrentProcess
LocalAlloc
CreateDirectoryW
GetTempPathW
GetModuleFileNameW
FindFirstFileW
FindNextFileW
FindClose
FindFirstFileExW
SetProcessWorkingSetSize

shell32

CommandLineToArgvW

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41.6MB - Virtual size: 41.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8cd5a0c4b03c3777190af5aaacdc95a8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

shell32

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: - Virtual size: 16B

.rsrc Size: 41.6MB - Virtual size: 41.6MB

.reloc Size: 512B - Virtual size: 412B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 16B

.rsrc
Size: 41.6MB - Virtual size: 41.6MB

.reloc
Size: 512B - Virtual size: 412B