c34c6cf513b7ef748eb68ee921cc70f7567d13701163f266c952cb3a003979dc

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target

c34c6cf513b7ef748eb68ee921cc70f7567d13701163f266c952cb3a003979dc
Size

13.3MB
MD5

ad2b7fa7c041b8f9589663f0444bbbea
SHA1

bf7fb6cf171b96bd7e640880ac561f1d2f61502a
SHA256

c34c6cf513b7ef748eb68ee921cc70f7567d13701163f266c952cb3a003979dc
SHA512

33da942fac337ad8c138ced14113e306b6abad5f20bd5d78e65af6819dfc9435bf29cecccc1fa07fa4156ebc16979d4b960a5a34711131eb5843a5fce67415bb
SSDEEP

393216:GospGz9SwGsCeWNr3HaWeEj96nCR2H/1VIJa:k8z9SwGsCemLHaWeE56njdV2a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c34c6cf513b7ef748eb68ee921cc70f7567d13701163f266c952cb3a003979dc

Files

c34c6cf513b7ef748eb68ee921cc70f7567d13701163f266c952cb3a003979dc
.exe windows:5 windows x86 arch:x86

a58c321926dc6fbf118744f8dcdc8cee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames

kernel32

GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharUpperBuffW

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox
Size: 340KB - Virtual size: 337KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vdata0
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vdata1
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.;VW
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tvmp
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tvmp
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.>=E
Size: 8.3MB - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

. $I
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vh:
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

a58c321926dc6fbf118744f8dcdc8cee

Headers

File Characteristics

Imports

msvbvm60

kernel32

user32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.data Size: 4KB - Virtual size: 30KB

.virbox Size: 340KB - Virtual size: 337KB

.vdata0 Size: 8KB - Virtual size: 4KB

.vdata1 Size: 12KB - Virtual size: 9KB

.;VW Size: 8KB - Virtual size: 7KB

.tvmp Size: 4KB - Virtual size: 4KB

.tvmp Size: 4KB - Virtual size: 4KB

.>=E Size: 8.3MB - Virtual size: 8.3MB

. $I Size: 4KB - Virtual size: 1KB

.vh: Size: 2.8MB - Virtual size: 2.8MB

.rsrc Size: 8KB - Virtual size: 7KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 4KB - Virtual size: 30KB

.virbox
Size: 340KB - Virtual size: 337KB

.vdata0
Size: 8KB - Virtual size: 4KB

.vdata1
Size: 12KB - Virtual size: 9KB

.;VW
Size: 8KB - Virtual size: 7KB

.tvmp
Size: 4KB - Virtual size: 4KB

.tvmp
Size: 4KB - Virtual size: 4KB

.>=E
Size: 8.3MB - Virtual size: 8.3MB

. $I
Size: 4KB - Virtual size: 1KB

.vh:
Size: 2.8MB - Virtual size: 2.8MB

.rsrc
Size: 8KB - Virtual size: 7KB