db59d97b3fa3869b50d04405ffbd2d2cba1e0da4e1b9d70d4b1200037838b75f

General

Target

db59d97b3fa3869b50d04405ffbd2d2cba1e0da4e1b9d70d4b1200037838b75f
Size

33KB
MD5

a3ed22abfd04aa9042d5617dec947a6a
SHA1

c98bac0359eabd512da2dc79946398653dffc8ac
SHA256

db59d97b3fa3869b50d04405ffbd2d2cba1e0da4e1b9d70d4b1200037838b75f
SHA512

107b8aa1e2bfad173007758daf573eb07747c5829b807d1c963afad9bd0c64382668ac47868d31efc873f04267c2d0d2cc11c17e654d20ecb454d13d0c7dc8a8
SSDEEP

384:p7N03DPc+04sxY2SNRhbHeJh8+oXBjxJd5IyYQGSbdkDjkoebjDISVjBWnbCWX:px8PY4sxYRbSEln5IyYpamDjobj8SAL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db59d97b3fa3869b50d04405ffbd2d2cba1e0da4e1b9d70d4b1200037838b75f

Files

db59d97b3fa3869b50d04405ffbd2d2cba1e0da4e1b9d70d4b1200037838b75f
.exe windows:5 windows x86 arch:x86

fa4d86a4e89ae79ea2a222aeb8f63583

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

rundll32.pdb

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_except_handler3
_wtoi
_vsnwprintf

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetErrorMode
DeactivateActCtx
GetCurrentProcessId
GetFileAttributesW
SearchPathW
CreateActCtxW
ActivateActCtx
LoadLibraryW
ReleaseActCtx
LocalAlloc
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CloseHandle
SetFilePointer
ReadFile
CreateFileW
WaitForSingleObject
CreateProcessW
Wow64EnableWow64FsRedirection
lstrcpynW
GetSystemDirectoryW
GetNativeSystemInfo
IsWow64Process
GetCurrentProcess
GetCommandLineW
FreeLibrary
LocalFree
lstrlenA
WideCharToMultiByte
GetLastError
lstrlenW
GetProcAddress
FormatMessageW
GetSystemTimeAsFileTime

gdi32

GetStockObject

user32

CharNextW
SetClassLongW
LoadIconW
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadCursorW
DestroyWindow
MessageBoxW
LoadStringW

imagehlp

ImageDirectoryEntryToData

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa4d86a4e89ae79ea2a222aeb8f63583

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

gdi32

user32

imagehlp

Sections

.text Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 884B

.rsrc Size: 25KB - Virtual size: 89KB

.text
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 884B

.rsrc
Size: 25KB - Virtual size: 89KB