efa7ff475a51b697cafd2817af4e6df47ebb598db3ac49e64063036a3cc64889

Sharing

Copy URL Twitter E-mail

General

Target

efa7ff475a51b697cafd2817af4e6df47ebb598db3ac49e64063036a3cc64889
Size

394KB
MD5

3328f95f218df4296d01adde238e38a6
SHA1

83f0517b90f2b47cbbd22407ad17ee94c582a171
SHA256

efa7ff475a51b697cafd2817af4e6df47ebb598db3ac49e64063036a3cc64889
SHA512

7784d68905b84748173d5b5fd34723e23548d1e6b4a1d89f0985d51cee8958a5846272bcb404b55c20f1003788fb66883945e8cf0333f68f66096020e7a83ad8
SSDEEP

1536:sEwagpQxBs9jkkk/n+5BMIBrTaympTHOwuNXTXoahnZePuK:N82PsLMn+XrTRNXTXoahnZ43

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efa7ff475a51b697cafd2817af4e6df47ebb598db3ac49e64063036a3cc64889

Files

efa7ff475a51b697cafd2817af4e6df47ebb598db3ac49e64063036a3cc64889
.exe windows:4 windows x86 arch:x86

f23f0cbf18b0aec3bcd2c88065919207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DrawTextA
TranslateMessage
GetMessageA
RegisterClassExA
LoadCursorA
EndDialog
SendMessageA
SetFocus
PostMessageA
DialogBoxParamA
DestroyWindow
BeginPaint
DispatchMessageA
EndPaint
PostQuitMessage
DefWindowProcA
CreateWindowExA
ShowWindow
UpdateWindow
LoadStringA
LoadIconA

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
HeapSize
RtlUnwind
HeapReAlloc
VirtualAlloc
Sleep
WriteProcessMemory
CreateDirectoryA
LoadLibraryA
GetModuleHandleA
lstrcpyA
GetCurrentDirectoryA
GetLocaleInfoA
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSection
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent

comctl32

ord17

wtsapi32

WTSLogoffSession
WTSEnumerateProcessesA
WTSWaitSystemEvent
WTSQuerySessionInformationA

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f23f0cbf18b0aec3bcd2c88065919207

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

comctl32

wtsapi32

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 11KB - Virtual size: 15KB

.rsrc Size: 21KB - Virtual size: 21KB

.shell Size: 320KB - Virtual size: 320KB

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 11KB - Virtual size: 15KB

.rsrc
Size: 21KB - Virtual size: 21KB

.shell
Size: 320KB - Virtual size: 320KB