9bf554663c28e8d57007fad69cbb6e64ca1241f50df38ba3cc5d8f8338d5ac97

Sharing

Copy URL Twitter E-mail

General

Target

9bf554663c28e8d57007fad69cbb6e64ca1241f50df38ba3cc5d8f8338d5ac97
Size

184KB
MD5

c54dc16d224df705455bb158e7ba7b99
SHA1

0c0209f64203749d7e7accee3d949bd88f0b6c4d
SHA256

9bf554663c28e8d57007fad69cbb6e64ca1241f50df38ba3cc5d8f8338d5ac97
SHA512

ba63aa2530f990f7768dd1e0fa3144e5a52232127cebf864283817e6e31ed85b89814608b917fe76b93d508e3a8560cc998f08989cf797a8e6ea2bba673b6a09
SSDEEP

1536:WvHYPPibvHhJw3RugEJ50Gnrlk+CMeZCervXiDN6nAEIbfhW37sj:WvHYPSLaRS8Gnrlk+fecxD0sj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9bf554663c28e8d57007fad69cbb6e64ca1241f50df38ba3cc5d8f8338d5ac97

Files

9bf554663c28e8d57007fad69cbb6e64ca1241f50df38ba3cc5d8f8338d5ac97
.exe windows:4 windows x86 arch:x86

f1aa3acffb08497ea6afd0b086922209

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetPrivateProfileIntW
GetFileAttributesW
GetLastError
FindNextFileW
FindClose
FindFirstFileW
HeapFree
GetStringTypeA
HeapAlloc
FlushFileBuffers
SetEnvironmentVariableA
CompareStringW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
CompareStringA
GetOEMCP
GetACP
GetCPInfo
SetStdHandle
LoadLibraryA
GetProcAddress
IsBadCodePtr
WriteFile
CloseHandle
GetModuleFileNameW
IsBadReadPtr
SetUnhandledExceptionFilter
RtlUnwind
GetVersion
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
GetFileAttributesA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetModuleFileNameA
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStringTypeW

user32

SendMessageW
IsDlgButtonChecked
FindWindowW
MessageBoxW

advapi32

CryptAcquireContextW
CryptReleaseContext

wintrust

CryptCATEnumerateMember
CryptCATPersistStore
CryptCATPutMemberInfo
CryptCATGetMemberInfo
CryptCATClose
CryptCATAdminCalcHashFromFileHandle
CryptCATOpen

crypt32

CryptSIPRetrieveSubjectGuid
CryptSIPLoad
CertAlgIdToOID

shlwapi

StrRChrW

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f1aa3acffb08497ea6afd0b086922209

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wintrust

crypt32

shlwapi

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 140KB - Virtual size: 160KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 140KB - Virtual size: 160KB