0c7d961b0f7b43409c4484fbe7fe20d10f7465ae7f60de7bf3603a8cd5d4c8c5

Sharing

Copy URL Twitter E-mail

General

Target

0c7d961b0f7b43409c4484fbe7fe20d10f7465ae7f60de7bf3603a8cd5d4c8c5
Size

79KB
MD5

a0db66ac9acf90dacd60a78adbdfc09f
SHA1

f151eddbf0de31a48eef185318cccbe7ba6e165f
SHA256

0c7d961b0f7b43409c4484fbe7fe20d10f7465ae7f60de7bf3603a8cd5d4c8c5
SHA512

6218d0f58a6b8f0509d65b002d20099ea8598a3fcf1de9a108f5d96e50e7357a37c76e11f823ed68269fa3795995b3f9fe70a960a304b87f348ffdc330ba8a3d
SSDEEP

1536:AodRQzRpL4cEMhFJ0cbYNmVyZ27639T+T8I03cccccccPG30tW:AodSPL4BmJ0ck6y8639T+wI0WG30tW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c7d961b0f7b43409c4484fbe7fe20d10f7465ae7f60de7bf3603a8cd5d4c8c5

Files

0c7d961b0f7b43409c4484fbe7fe20d10f7465ae7f60de7bf3603a8cd5d4c8c5
.exe windows:5 windows x86 arch:x86

ee66159141d18e0e03106af71b6e4491

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

LicMgr.pdb

Imports

lrwizdll

ord4
ord3
ord5

mstlsapi

ord2
ord24
ord28
ord136
ord132
ord26
ord8
ord4
ord44
ord15
ord16
ord17
ord18
ord45
ord20
ord29
ord5

shell32

ShellAboutW

mfc42u

ord3826
ord3820
ord3074
ord4075
ord4621
ord4419
ord3592
ord641
ord324
ord4229
ord4704
ord2637
ord5276
ord2371
ord825
ord800
ord5798
ord2809
ord540
ord1196
ord3490
ord4370
ord2634
ord3087
ord4155
ord861
ord5214
ord3658
ord617
ord296
ord1172
ord2281
ord2362
ord4609
ord4606
ord4604
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord4418
ord3733
ord815
ord561
ord823
ord6211
ord5297
ord858
ord5208
ord986
ord520
ord4154
ord6113
ord2613
ord1131
ord4608
ord4607
ord535
ord1934
ord4267
ord5255
ord2527
ord1165
ord4215
ord2576
ord3649
ord2430
ord2858
ord1637
ord1143
ord813
ord4583
ord4582
ord4893
ord4364
ord4886
ord4526
ord5070
ord4335
ord4343
ord4717
ord4884
ord4525
ord4539
ord4537
ord4520
ord4523
ord4518
ord3825
ord4955
ord4103
ord6051
ord1768
ord5236
ord5286
ord3743
ord1719
ord3394
ord4426
ord3729
ord303
ord384
ord686
ord2910
ord3282
ord538
ord3298
ord2857
ord4120
ord6266
ord3909
ord3291
ord2088
ord4279
ord2836
ord2099
ord922
ord925
ord5446
ord6390
ord5436
ord6379
ord1834
ord4237
ord2715
ord2382
ord3054
ord5094
ord5097
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5233
ord5278
ord2641
ord1658
ord4430
ord4421
ord796
ord794
ord674
ord554
ord529
ord527
ord366
ord807
ord5248
ord5848
ord1662
ord2644
ord5677
ord4158
ord2486
ord2619
ord2618
ord5867
ord2112
ord4451
ord3476
ord2244
ord2879
ord1197
ord6898
ord3281
ord1841
ord4239
ord2575
ord4397
ord5249
ord2400
ord6896
ord3366
ord3636
ord2606
ord2810
ord3905
ord3288
ord3296
ord3579
ord543
ord803
ord1817
ord4233
ord4690
ord3053
ord3060
ord6332
ord2502
ord2534
ord5239
ord5736
ord1739
ord5573
ord3167
ord5649
ord4414
ord4947
ord4852
ord2391
ord4381
ord3449
ord3193
ord6076
ord6171
ord4617
ord4420
ord652
ord338
ord4817
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4847
ord5261
ord4958
ord1569

msvcrt

__CxxFrameHandler
_wcsicmp
_except_handler3
wcscmp
_ltow
wcscpy
wcsncpy
wcscat
localtime
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
__dllonexit
_onexit
_controlfp
?terminate@@YAXXZ

advapi32

RegOpenKeyExA
LsaOpenPolicy
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
LsaClose
RegQueryValueExA

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetUserDefaultUILanguage
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
VirtualAlloc
VirtualProtect
VirtualFree
GetSystemInfo
LeaveCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringW
CloseHandle
ResumeThread
WaitForSingleObject
SetLastError
InterlockedExchange
ExitThread
LocalFree
CreateThread
LoadLibraryA
LoadLibraryW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetLastError
GetModuleFileNameW
OutputDebugStringA
LoadLibraryExW
FreeLibrary
lstrcpyW
lstrlenW
GetComputerNameW
EnterCriticalSection

user32

GetClientRect
CreateWindowExW
GetMenu
CheckMenuRadioItem
PtInRect
EnableMenuItem
LoadIconW
GetCursorPos
LoadStringW
LoadCursorW
SetCursor
ScreenToClient
SetWindowPos
SendMessageW
LoadMenuW
GetSubMenu
UpdateWindow
EnableWindow
PostMessageW
ClientToScreen

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee66159141d18e0e03106af71b6e4491

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

lrwizdll

mstlsapi

shell32

mfc42u

msvcrt

advapi32

kernel32

user32

Sections

.text Size: 54KB - Virtual size: 53KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 23KB - Virtual size: 55KB

.text
Size: 54KB - Virtual size: 53KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 23KB - Virtual size: 55KB