e09c16609a62f6adf0a484ae85bdee71ad389b1b665c23fc7be1ebe0bda98019

Sharing

Copy URL Twitter E-mail

General

Target

e09c16609a62f6adf0a484ae85bdee71ad389b1b665c23fc7be1ebe0bda98019
Size

408KB
MD5

b5820daef773f713a754b20049660aa3
SHA1

996b16126d04623160cdaa1488aecdaacee33519
SHA256

e09c16609a62f6adf0a484ae85bdee71ad389b1b665c23fc7be1ebe0bda98019
SHA512

9001ee1a61a574ebe450a3320aef4d2a541b1c37307a7360cde2d254ee33360bf2cec36c140a2d45d1edc7ebd9e74ddfa77f0e2454447b3ff63ee8e030ffe4b9
SSDEEP

1536:kPt5xOTwOwzlra7MQocx4onbuykoi0TzSfkxtQg/r82q:yOTw+EcgykEYItQGK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e09c16609a62f6adf0a484ae85bdee71ad389b1b665c23fc7be1ebe0bda98019

Files

e09c16609a62f6adf0a484ae85bdee71ad389b1b665c23fc7be1ebe0bda98019
.exe windows:4 windows x86 arch:x86

bc73abdedfd0c3cdc838e841d6ae6355

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\jd\jd(RegRun)\release\jd3(reg).pdb

Imports

kernel32

WideCharToMultiByte
Sleep
CreateProcessA
ReadFile
GetSystemDirectoryA
MultiByteToWideChar
GetLastError
GetProcAddress
VirtualAlloc
LoadLibraryA
WaitForMultipleObjects
GetOEMCP
GetVersionExA
CloseHandle
GetTempPathA
DeleteFileA
CreateThread
WriteFile
VirtualFree
GetFileSize
CopyFileA
CreateFileA
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
GetFileAttributesA
ExitThread
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
RtlUnwind
GetConsoleCP
GetConsoleMode
RaiseException
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
SetStdHandle
InitializeCriticalSection
FlushFileBuffers
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

advapi32

GetUserNameA
RegOpenKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

wininet

InternetConnectA
InternetReadFile
HttpOpenRequestA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA

ws2_32

WSACleanup
WSAStartup
inet_ntoa
gethostname
gethostbyname

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc73abdedfd0c3cdc838e841d6ae6355

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

wininet

ws2_32

Sections

.text Size: 56KB - Virtual size: 52KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 176B

.shell Size: 320KB - Virtual size: 320KB

.text
Size: 56KB - Virtual size: 52KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 176B

.shell
Size: 320KB - Virtual size: 320KB