dc6c2b29f582c820372813487ddf1de0N

Sharing

Copy URL

Twitter E-mail

General

Target

dc6c2b29f582c820372813487ddf1de0N
Size

103KB
MD5

dc6c2b29f582c820372813487ddf1de0
SHA1

c8d08a4352790a52250968b37f08b19097a9b152
SHA256

95590d152ec59f4eafcbf996c1d4f20ac484d2ca3d3bb7f68fdfd5327b4f3225
SHA512

695d4d360b8153da6ebb42b2f3a58d12e1153da052428fdb993e3920b0045ed2ae066ed1f3b30fe4456dcc267c9140c043b4fa78d0bda8ce3d9684ffb796f782
SSDEEP

3072:NO2qdTK9shIPFJRAhP2EAeJQDmppz6v2zY:NO2YTKDDeP/pz6v2s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc6c2b29f582c820372813487ddf1de0N

Files

dc6c2b29f582c820372813487ddf1de0N
.exe windows:6 windows x86 arch:x86

22300191c1c79f65815db76c38ca9037

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

WinMgmt.pdb

Imports

kernel32

LCMapStringW
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
GetCommandLineW
CloseHandle
CreateProcessW
RegisterApplicationRestart
GetCurrentProcessId
GetCommandLineA
GetModuleHandleW
SetThreadPreferredUILanguages
HeapSetInformation
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
Sleep
InterlockedExchange
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

msvcrt

_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
exit
_exit
__wgetmainargs
setlocale
strspn
mbstowcs
isspace
atoi
memset
__CxxFrameHandler3
_XcptFilter
_vsnwprintf
_vsnprintf
_cexit

wbemcomn

?GetWMIADAPCmdLine@@YGPAGH@Z
?GetMemLogObject@@YGPAVCMemoryLog@@XZ
?Write@CMemoryLog@@QAEXJ@Z
?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z
?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z
?EnablePrivilege@@YGHKJ@Z
?DebugTrace@@YAHDPBDZZ

ntdll

EtwTraceMessage

shell32

CommandLineToArgvW

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

22300191c1c79f65815db76c38ca9037

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

wbemcomn

ntdll

shell32

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 13KB

.rsrc Size: 63KB - Virtual size: 62KB

.reloc Size: 28KB - Virtual size: 29KB

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 13KB

.rsrc
Size: 63KB - Virtual size: 62KB

.reloc
Size: 28KB - Virtual size: 29KB