Ohz2N1pNjdq5HyRkYOMC3ZC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Ohz2N1pNjdq5HyRkYOMC3ZC.exe
Size

41.9MB
MD5

95a49ff1dbd85502dda4df87b2bc5101
SHA1

25c905816a6e4b8abcf9eb0a382cc7cc470d7b2e
SHA256

92ad87fe01320733afcb04a8b6f129a71dcd1769cab83326e8eee1175447af27
SHA512

c95fc5005cf24816621091ae52adb74dfb66698c7c277c776ec1545b806d86a28d98f3814e926f87daaca28323fce3b44ffb2aec958ccff1643ca83b2d5184a7
SSDEEP

786432:BXv8WsMlcj0AsXmQlFTD1JF9S5iOFW9hc2K4pRdvHI+QcnpDf:BXEAWjN4pFNs5A9h1F5Qc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ohz2N1pNjdq5HyRkYOMC3ZC.exe

Files

Ohz2N1pNjdq5HyRkYOMC3ZC.exe
.exe windows:6 windows x64 arch:x64

92ac1b8f46d91c02a3b0c7e1d89a12ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVersionExA

user32

GetWindowThreadProcessId

advapi32

CryptGetProvParam

shell32

SHGetFolderPathW

ole32

CoSetProxyBlanket

oleaut32

SysFreeString

msvcp140

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

normaliz

IdnToAscii

wldap32

ord22

crypt32

CertFreeCertificateChain

ws2_32

select

shlwapi

StrStrW

ntdll

NtLoadDriver

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-convert-l1-1-0

_atoi64

api-ms-win-crt-runtime-l1-1-0

_crt_atexit

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-string-l1-1-0

isupper

api-ms-win-crt-time-l1-1-0

_tzset

api-ms-win-crt-stdio-l1-1-0

fopen

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 939KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 35.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 41.9MB - Virtual size: 41.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92ac1b8f46d91c02a3b0c7e1d89a12ef

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

normaliz

wldap32

crypt32

ws2_32

shlwapi

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 2.6MB

.rdata Size: - Virtual size: 939KB

.data Size: - Virtual size: 538KB

.pdata Size: - Virtual size: 73KB

Size: - Virtual size: 35.5MB

Size: 5KB - Virtual size: 5KB

Size: 41.9MB - Virtual size: 41.9MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 2.6MB

.rdata
Size: - Virtual size: 939KB

.data
Size: - Virtual size: 538KB

.pdata
Size: - Virtual size: 73KB

.rsrc
Size: 512B - Virtual size: 480B