e70ac3b8d7f58eefba07ca70101030478372e28e6255a723f82038795475feb8

Sharing

Copy URL Twitter E-mail

General

Target

e70ac3b8d7f58eefba07ca70101030478372e28e6255a723f82038795475feb8
Size

6.2MB
MD5

332edb4ea9b240218b82bdb0a02175f7
SHA1

42e0067a2994f102b354289a3028863a9f424516
SHA256

e70ac3b8d7f58eefba07ca70101030478372e28e6255a723f82038795475feb8
SHA512

31227e778b3e7a7a10450db06c083178ad29295309f28745563ce79832aa9781a95e80a2daac8f06e51834bd86f665afe906e57eb35bd04686491aabd2f7cea0
SSDEEP

98304:57tjupDCSt4CDI15xUwBjQMo5553Tb9sXGsQgb//HLftWzhWauK19/IR5T:Ztu2St4j5xlOMmnG9b//odWauK7I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e70ac3b8d7f58eefba07ca70101030478372e28e6255a723f82038795475feb8

Files

e70ac3b8d7f58eefba07ca70101030478372e28e6255a723f82038795475feb8
.exe windows:6 windows x86 arch:x86

bae0daaa0718f1a2874fb1a32d411bd7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MiniDumpWriteDump

libcef

cef_print_settings_create

imm32

ImmReleaseContext

iphlpapi

GetAdaptersAddresses

shell32

SHGetPathFromIDListW

propsys

PSGetPropertyKeyFromName

winhttp

WinHttpOpen

rpcrt4

UuidCreate

d3d9

Direct3DCreate9

gdiplus

GdipCreateImageAttributes

crypt32

CertVerifyCertificateChainPolicy

advapi32

AllocateAndInitializeSid

user32

RegisterClassExW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

wsock32

WSAGetLastError

ws2_32

getaddrinfo

secur32

InitializeSecurityContextW

kernel32

GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

gdi32

DeleteObject

ole32

CoCreateInstance

comdlg32

GetSaveFileNameW

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 903B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ubx0
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ubx1
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bae0daaa0718f1a2874fb1a32d411bd7

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

libcef

imm32

iphlpapi

shell32

propsys

winhttp

rpcrt4

d3d9

gdiplus

crypt32

advapi32

user32

wsock32

ws2_32

secur32

kernel32

gdi32

ole32

comdlg32

wtsapi32

Sections

.text Size: - Virtual size: 4.0MB

.rdata Size: - Virtual size: 602KB

.data Size: - Virtual size: 112KB

.idata Size: - Virtual size: 20KB

.tls Size: 1024B - Virtual size: 903B

.00cfg Size: - Virtual size: 270B

.ubx0 Size: - Virtual size: 2.9MB

.ubx1 Size: 6.0MB - Virtual size: 6.0MB

.rsrc Size: 193KB - Virtual size: 193KB

.text
Size: - Virtual size: 4.0MB

.rdata
Size: - Virtual size: 602KB

.data
Size: - Virtual size: 112KB

.idata
Size: - Virtual size: 20KB

.tls
Size: 1024B - Virtual size: 903B

.00cfg
Size: - Virtual size: 270B

.ubx0
Size: - Virtual size: 2.9MB

.ubx1
Size: 6.0MB - Virtual size: 6.0MB

.rsrc
Size: 193KB - Virtual size: 193KB