72713ccb5893f1bf00662aa77eb55e2700db6020f585f72eaf97e3064e0ca7f4

Sharing

Copy URL Twitter E-mail

General

Target

72713ccb5893f1bf00662aa77eb55e2700db6020f585f72eaf97e3064e0ca7f4
Size

10.9MB
MD5

7109d89c1a4101cd4ec10f85c8ba6949
SHA1

cf2a19f03c93b028acc42d37cfd44c15271cea6a
SHA256

72713ccb5893f1bf00662aa77eb55e2700db6020f585f72eaf97e3064e0ca7f4
SHA512

3d934d06433a0b64f0c5578ed1a8c00257954ed82711c9d129266a1ad95cb5cb2d0071f06a908380f624f95e03c018742ddc21d73db6073f7e89c52a3f30e9a9
SSDEEP

196608:zIvq727ayag6q2SWfg/1uk0EdkC5Lb2UK7aB5M39slWn9XWq4pQ1:Ebaye8/UM5Lb2UKODoa49f4+1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72713ccb5893f1bf00662aa77eb55e2700db6020f585f72eaf97e3064e0ca7f4

Files

72713ccb5893f1bf00662aa77eb55e2700db6020f585f72eaf97e3064e0ca7f4
.exe windows:5 windows x86 arch:x86

85ccc8046150a57ee3dee1b2fa71e182

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetVersionExA
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

shlwapi

StrTrimA

user32

LoadKeyboardLayoutA
KillTimer
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

ole32

CLSIDFromProgID

advapi32

RegCreateKeyExA
RegQueryValueExA

comdlg32

GetSaveFileNameA

gdiplus

GdiplusStartup

shell32

SHGetFileInfoA
Shell_NotifyIconA

wsock32

ord1140

dbghelp

MakeSureDirectoryPathExists

winhttp

WinHttpTimeFromSystemTime

oleaut32

VariantInit
SysAllocStringByteLen

gdi32

SetBkMode
ExcludeClipRect

wininet

InternetOpenA
InternetCloseHandle

version

GetFileVersionInfoA

psapi

GetModuleFileNameExA

imm32

ImmInstallIMEA

ws2_32

WSACloseEvent
inet_ntoa

winspool.drv

ClosePrinter
OpenPrinterA

comctl32

ord17
ImageList_GetIcon

oledlg

ord8

winmm

midiStreamStop

rasapi32

RasHangUpA

msimg32

GradientFill

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.3Km0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.3Km1
Size: 10.9MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85ccc8046150a57ee3dee1b2fa71e182

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

ole32

advapi32

comdlg32

gdiplus

shell32

wsock32

dbghelp

winhttp

oleaut32

gdi32

wininet

version

psapi

imm32

ws2_32

winspool.drv

comctl32

oledlg

winmm

rasapi32

msimg32

wtsapi32

Sections

.text Size: - Virtual size: 4.8MB

.rdata Size: - Virtual size: 4.5MB

.data Size: - Virtual size: 2.2MB

.3Km0 Size: - Virtual size: 3.2MB

.3Km1 Size: 10.9MB - Virtual size: 10.9MB

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: - Virtual size: 4.8MB

.rdata
Size: - Virtual size: 4.5MB

.data
Size: - Virtual size: 2.2MB

.3Km0
Size: - Virtual size: 3.2MB

.3Km1
Size: 10.9MB - Virtual size: 10.9MB

.rsrc
Size: 8KB - Virtual size: 6KB