d50864fb596ceb7c408bcc42c29d808d28a6cc71d5bb84b46a6b1d017384278e

Sharing

Copy URL

Twitter E-mail

General

Target

d50864fb596ceb7c408bcc42c29d808d28a6cc71d5bb84b46a6b1d017384278e
Size

69KB
MD5

6be0aab0f388231665e6a9dee40edb2c
SHA1

cf84ad6041dc327400e68926658eb5f4454cc935
SHA256

d50864fb596ceb7c408bcc42c29d808d28a6cc71d5bb84b46a6b1d017384278e
SHA512

1b5c3f6815d387866998676c6e88a7bd188c380dace770db81d45c681c59bec0346fb045d8302fd40cd7b29e61b335a7842693a4a6ac3feda7b31b66c08f179f
SSDEEP

1536:0zg0V4WOlaj0SgNRTEiqfl+loto8iN7dFdpx5R:KYayNGS8iNHx5R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d50864fb596ceb7c408bcc42c29d808d28a6cc71d5bb84b46a6b1d017384278e

Files

d50864fb596ceb7c408bcc42c29d808d28a6cc71d5bb84b46a6b1d017384278e
.exe windows:5 windows x86 arch:x86

82104cc9804a1886208ad9692c1bf710

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
DeleteFileA
RemoveDirectoryA
LoadLibraryA
FreeLibrary
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetModuleFileNameA
GetShortPathNameA
GetEnvironmentVariableA
GetModuleHandleA
MultiByteToWideChar
GetWindowsDirectoryA
GetLastError
GetFileAttributesA
GetModuleHandleW
ExitProcess
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
WideCharToMultiByte
LCMapStringW
WriteFile
GetStdHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapSize
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
IsValidCodePage
GetCurrentProcess

user32

MessageBoxA

advapi32

RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey

shell32

ShellExecuteA
SHGetSpecialFolderPathA
SHFileOperationA

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82104cc9804a1886208ad9692c1bf710

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 448B

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 448B