e93daf42b138e31b82e9eb42aa7c1646c20aff91310cf2edafb4ce3e36f3f935

Sharing

Copy URL Twitter E-mail

General

Target

e93daf42b138e31b82e9eb42aa7c1646c20aff91310cf2edafb4ce3e36f3f935
Size

8.4MB
MD5

de76af56c014faa9de3503173e1af361
SHA1

1fe32e4437426f1697fb7d6b85e225ecfd46984e
SHA256

e93daf42b138e31b82e9eb42aa7c1646c20aff91310cf2edafb4ce3e36f3f935
SHA512

e5df2293b9356dbff051db4a6c475c1367cd23026bf6340eb8fb0547a823d14b80f4c6ac5fdc781d32a50a4ec8d444ba6aa0893222f114691d487d2d215f8d58
SSDEEP

196608:5NSCorpLyj3/R48G6tDPdorV8jsmBGOgN77rewZypZVcnZ+DI1:5cCordyj3CJW1orVuDIp33QHQ4I1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e93daf42b138e31b82e9eb42aa7c1646c20aff91310cf2edafb4ce3e36f3f935

Files

e93daf42b138e31b82e9eb42aa7c1646c20aff91310cf2edafb4ce3e36f3f935
.exe windows:6 windows x64 arch:x64

4ce2ce290fcce11ecb9f0f43a1b9b43b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

gdi32

BitBlt

kernel32

GetVersionExA
GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

___lc_codepage_func

user32

ActivateKeyboardLayout
CharUpperBuffW

wtsapi32

WTSSendMessageW

Exports

Exports

_cgo_dummy_export
authorizerTrampoline
callbackTrampoline
commitHookTrampoline
compareTrampoline
doneTrampoline
goELEMENT_COMPARATOR
goElementEventProc
goKeyValueCallback
goLPCBYTE_RECEIVER
goLPCSTR_RECEIVER
goLPCWSTR_RECEIVER
goNATIVE_FUNCTOR_INVOKE
goNATIVE_FUNCTOR_RELEASE
goSciterElementCallback
goSciterHostCallback
go_send
hook_create_screen_info
hook_get_auto_repeat_delay
hook_get_auto_repeat_rate
hook_get_multi_click_time
hook_get_pointer_acceleration_multiplier
hook_get_pointer_acceleration_threshold
hook_get_pointer_sensitivity
hook_post_event
hook_run
hook_set_dispatch_proc
hook_set_logger
hook_stop
preUpdateHookTrampoline
rollbackHookTrampoline
stepTrampoline
updateHookTrampoline

Sections

.text
Size: - Virtual size: 7.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 6.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 459KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 8.3MB - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4ce2ce290fcce11ecb9f0f43a1b9b43b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

user32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 7.9MB

.data Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 6.8MB

.pdata Size: - Virtual size: 36KB

.xdata Size: - Virtual size: 36KB

.bss Size: - Virtual size: 459KB

.edata Size: - Virtual size: 1KB

.idata Size: - Virtual size: 9KB

.CRT Size: - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.vmp0 Size: - Virtual size: 3.3MB

.vmp1 Size: 8.3MB - Virtual size: 8.3MB

.reloc Size: 512B - Virtual size: 36B

.rsrc Size: 19KB - Virtual size: 18KB

.text
Size: - Virtual size: 7.9MB

.data
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 6.8MB

.pdata
Size: - Virtual size: 36KB

.xdata
Size: - Virtual size: 36KB

.bss
Size: - Virtual size: 459KB

.edata
Size: - Virtual size: 1KB

.idata
Size: - Virtual size: 9KB

.CRT
Size: - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.vmp0
Size: - Virtual size: 3.3MB

.vmp1
Size: 8.3MB - Virtual size: 8.3MB

.reloc
Size: 512B - Virtual size: 36B

.rsrc
Size: 19KB - Virtual size: 18KB