ef9d728adaf782f2bdaeeb07aacbc550N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ef9d728adaf782f2bdaeeb07aacbc550N.exe
Size

203KB
MD5

ef9d728adaf782f2bdaeeb07aacbc550
SHA1

60482d9edae4e8961c43814a44a37e16973fc37b
SHA256

65b2d2bbc523663fe9fb58a6aba2bf2c0a833299311c6575592d0c44664f0584
SHA512

81e47fb891fbc06f610a3783875dc9b1b652962fd4104a8b21eed4eefed3164719e772b84a80209abb9c49665b94c6924a019905b050f680f5413a1b363f3328
SSDEEP

3072:01g2ZB+GEhO118/bPyKxM4QTJt2cWGsNPKisJoyjK7yGAe9Q0enyU8GZqaP+wPml:WhYzxMlNNsAisDRGAL0eyUBnPrPO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef9d728adaf782f2bdaeeb07aacbc550N.exe

Files

ef9d728adaf782f2bdaeeb07aacbc550N.exe
.exe windows:4 windows x86 arch:x86

3b42f9693bdd770281b738cfac146ecf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AddAtomW
lstrcpynW
GetModuleFileNameA
GetFileType
GetEnvironmentStringsA
GetProcAddress
BeginUpdateResourceW
GetCurrentThreadId
CreateMailslotW
AddAtomA
lstrlen
GetEnvironmentStringsW
GetExpandedNameA
WinExec
GetCurrentProcessId
GetThreadPriority
FindAtomA
OpenWaitableTimerW
GetModuleHandleA
GetLocaleInfoA
GetDateFormatA
GetShortPathNameW

user32

GetParent
CreateWindowExA
SetDlgItemTextW
DestroyIcon
GetDlgItemInt
IsWindow
IsMenu
PostMessageA
SetWindowLongW
GetWindowTextW
CallWindowProcW
GetCapture
GetSubMenu
InvalidateRect
DestroyWindow
GetDlgItem
WinHelpA
GetSystemMetrics
SetCursorPos
CreateCaret
CascadeWindows
EnumDesktopsA
GetDCEx
EndDialog
CreatePopupMenu
GetMessageA
GetCursorPos
CreateAcceleratorTableW
GetTopWindow
SetWindowRgn
SendMessageA

gdi32

ColorMatchToTarget
CreateCompatibleDC
Pie
CopyMetaFileW
ExtTextOutW
GetTextColor
SetColorAdjustment
CreatePatternBrush
SetMetaRgn
ExtFloodFill
GetEnhMetaFileDescriptionA
SetTextColor
ExtSelectClipRgn
AddFontResourceW
EndDoc
GetTextFaceW
GetCharacterPlacementA
GetMetaFileA

advapi32

RegOpenKeyW
RegFlushKey
RegOpenKeyA

shlwapi

GetMenuPosFromID
PathUnmakeSystemFolderA
UrlIsNoHistoryW
PathIsURLA
SHCreateShellPalette
PathRemoveArgsW
SHCopyKeyW
SHRegOpenUSKeyA
PathSearchAndQualifyW

Sections

.eX
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ah
Size: 2KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wc
Size: 512B - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cKgaFt
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.JbcCcw
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b42f9693bdd770281b738cfac146ecf

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shlwapi

Sections

.eX Size: 12KB - Virtual size: 11KB

.ah Size: 2KB - Virtual size: 31KB

.wc Size: 512B - Virtual size: 402KB

.cKgaFt Size: 8KB - Virtual size: 8KB

.JbcCcw Size: 5KB - Virtual size: 11KB

.rsrc Size: 172KB - Virtual size: 171KB

.reloc Size: 1024B - Virtual size: 928B

.eX
Size: 12KB - Virtual size: 11KB

.ah
Size: 2KB - Virtual size: 31KB

.wc
Size: 512B - Virtual size: 402KB

.cKgaFt
Size: 8KB - Virtual size: 8KB

.JbcCcw
Size: 5KB - Virtual size: 11KB

.rsrc
Size: 172KB - Virtual size: 171KB

.reloc
Size: 1024B - Virtual size: 928B