0c55281861a92e1c6870e8a474a71a10N

Sharing

Copy URL

Twitter E-mail

General

Target

0c55281861a92e1c6870e8a474a71a10N
Size

103KB
MD5

0c55281861a92e1c6870e8a474a71a10
SHA1

6c9b9eb29bff3f409c20cd1b73f52b9ea4a64780
SHA256

1db29c76a362e248432f78c04a0d20f6bc1a60e35f0fda304373f595b1f73970
SHA512

e8a096f66f57fbbd6dc672e52c977961e320a6d619c0b214a88fc0c3fb7c3b368a6e29e238e3aac5413df054dd9447e067a18751d1d5452ecfefbe568bcf0b00
SSDEEP

3072:6O2qdTK9shIPFJRAhP2EAeJwUZkA9LCAq:6O2YTKDDePkUZkAk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c55281861a92e1c6870e8a474a71a10N

Files

0c55281861a92e1c6870e8a474a71a10N
.exe windows:6 windows x86 arch:x86

22300191c1c79f65815db76c38ca9037

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

WinMgmt.pdb

Imports

kernel32

LCMapStringW
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
GetCommandLineW
CloseHandle
CreateProcessW
RegisterApplicationRestart
GetCurrentProcessId
GetCommandLineA
GetModuleHandleW
SetThreadPreferredUILanguages
HeapSetInformation
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
Sleep
InterlockedExchange
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

msvcrt

_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
exit
_exit
__wgetmainargs
setlocale
strspn
mbstowcs
isspace
atoi
memset
__CxxFrameHandler3
_XcptFilter
_vsnwprintf
_vsnprintf
_cexit

wbemcomn

?GetWMIADAPCmdLine@@YGPAGH@Z
?GetMemLogObject@@YGPAVCMemoryLog@@XZ
?Write@CMemoryLog@@QAEXJ@Z
?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z
?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z
?EnablePrivilege@@YGHKJ@Z
?DebugTrace@@YAHDPBDZZ

ntdll

EtwTraceMessage

shell32

CommandLineToArgvW

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

22300191c1c79f65815db76c38ca9037

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

wbemcomn

ntdll

shell32

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 13KB

.rsrc Size: 63KB - Virtual size: 62KB

.reloc Size: 28KB - Virtual size: 29KB

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 13KB

.rsrc
Size: 63KB - Virtual size: 62KB

.reloc
Size: 28KB - Virtual size: 29KB