ef8413056022816887474a74d663f964352617e8ac18ab251b5da387b7d059a9

General

Target

ef8413056022816887474a74d663f964352617e8ac18ab251b5da387b7d059a9
Size

119KB
MD5

7646290622c209bee1de91106f748f81
SHA1

bab064c6b90d1c6ed4d907c53bc02d267f8d06ca
SHA256

ef8413056022816887474a74d663f964352617e8ac18ab251b5da387b7d059a9
SHA512

f493729a845f00a4723b303b41bc274e59f930e322a1e2316f89cb9e7ff4e4d7d2544fb3f0b8e0c011f9cd815b577e7977093dcc4baae2ee3b5ab4f3b5c69221
SSDEEP

768:FPy56wTz/A780mpqiHZplRRqpd6rnxn7A4xifivsWdvbh7pgh:F6RAo0Yj2d6rnJk4IUFdvbh7pgh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef8413056022816887474a74d663f964352617e8ac18ab251b5da387b7d059a9

Files

ef8413056022816887474a74d663f964352617e8ac18ab251b5da387b7d059a9
.exe windows:4 windows x86 arch:x86

ed42d4abceb2444958dc2f2ce7063809

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyA
RegOpenKeyA
RegCloseKey

iphlpapi

GetAdaptersInfo

kernel32

GetStringTypeA
LCMapStringW
WaitForSingleObject
CreateThread
HeapFree
DeleteFileA
ExitProcess
lstrcmpiA
lstrcatA
GetWindowsDirectoryA
HeapAlloc
GetProcessHeap
Sleep
GetModuleFileNameA
CloseHandle
GetLastError
CreateMutexA
GetProcAddress
LoadLibraryA
HeapReAlloc
GetTickCount
FindClose
FindFirstFileA
TerminateProcess
CreateProcessA
CreateFileA
ReadFile
WriteFile
FlushFileBuffers
GetFileSize
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
GetCurrentProcess
GetStdHandle
WideCharToMultiByte

wininet

InternetOpenA
InternetSetOptionExA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile

user32

wsprintfA

Sections

.MPRESS1
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ed42d4abceb2444958dc2f2ce7063809

Headers

File Characteristics

Imports

advapi32

iphlpapi

kernel32

wininet

user32

Sections

.MPRESS1 Size: 48KB - Virtual size: 48KB

.MPRESS2 Size: 64KB - Virtual size: 64KB

.MPRESS1
Size: 48KB - Virtual size: 48KB

.MPRESS2
Size: 64KB - Virtual size: 64KB