e96be2e3629d09da00e0501475491a7d8a834870eb3adf3c2a2db85f57783dbfN

Sharing

Copy URL

Twitter E-mail

General

Target

e96be2e3629d09da00e0501475491a7d8a834870eb3adf3c2a2db85f57783dbfN
Size

80KB
MD5

e5b7430ffd004403968acfafa73ee150
SHA1

bfa62c78fa106836b03a2e0a18e7728ad29c745f
SHA256

e96be2e3629d09da00e0501475491a7d8a834870eb3adf3c2a2db85f57783dbf
SHA512

07f641fe847f11366190de2c88af1e7732db6b2b19f5366edd4b5cca09ead3e145034a49a77b112c3297c05e57931671fe9a225e67f3e18d6ba9896e19abedaa
SSDEEP

1536:ZPPEyu6yr1OY+4RI2WGBoxj54UrMW1jFLuMSADz72mMyWsSsM:ZPP7u7x5WqU+UgW/yuDvPxWs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e96be2e3629d09da00e0501475491a7d8a834870eb3adf3c2a2db85f57783dbfN

Files

e96be2e3629d09da00e0501475491a7d8a834870eb3adf3c2a2db85f57783dbfN
.exe windows:4 windows x86 arch:x86

ec56ff4a0ae274c36bc94f9bccf139b8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

user32

PostQuitMessage
SetWindowPos
UnhookWindowsHookEx
SetWindowTextA
EnumWindows
FrameRect
EqualRect
GetMessageA
GetSysColorBrush
GetSubMenu
EnableMenuItem
GetScrollPos
GetSysColor

kernel32

ExitProcess
GetTickCount
GetThreadLocale
GetCurrentProcessId
InterlockedExchange
FileTimeToSystemTime
GetTimeZoneInformation
GetTempPathA
VirtualAllocEx
RtlUnwind
GetSystemTime
SetUnhandledExceptionFilter
GetStartupInfoA
GetFileAttributesA
GetOEMCP

gdi32

CopyEnhMetaFileA
FillRgn
GetMapMode
DPtoLP
SetViewportExtEx
ExcludeClipRect
SelectClipPath
CreateICW
CreateCompatibleBitmap

ole32

DoDragDrop
CoTaskMemRealloc
StgOpenStorage
CoRevokeClassObject
OleRun
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoCreateInstance

advapi32

GetUserNameA
RegQueryValueExW
GetSecurityDescriptorDacl
RegCreateKeyA
CryptHashData
CheckTokenMembership
FreeSid
AdjustTokenPrivileges
QueryServiceStatus
RegCreateKeyExW

msvcrt

_mbscmp
strncpy
__setusermatherr
_fdopen
strlen
strcspn
raise
iswspace
_flsbuf
__initenv
__getmainargs
fflush
_CIpow
signal
puts
fprintf
_strdup
_lock

comctl32

ImageList_Write
ImageList_Destroy
CreatePropertySheetPageA
ImageList_LoadImageA
ImageList_DragEnter
ImageList_SetIconSize
ImageList_GetIcon
ImageList_GetBkColor
ImageList_DrawEx
ImageList_LoadImageW
InitCommonControls
ImageList_GetIconSize
ImageList_ReplaceIcon

shell32

ShellExecuteEx
CommandLineToArgvW
SHGetPathFromIDList
SHBrowseForFolderA
DragQueryFileA
ExtractIconExW
ExtractIconW
DragAcceptFiles
ShellExecuteW
DoEnvironmentSubstW
DragQueryFileW

oleaut32

VariantCopy
SafeArrayGetUBound
SysReAllocStringLen
SafeArrayPtrOfIndex
SafeArrayCreate
SafeArrayPutElement
SafeArrayRedim
SafeArrayUnaccessData

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ec56ff4a0ae274c36bc94f9bccf139b8

Headers

File Characteristics

Imports

user32

kernel32

gdi32

ole32

advapi32

msvcrt

comctl32

shell32

oleaut32

Sections

.text Size: 33KB - Virtual size: 32KB

.data Size: 40KB - Virtual size: 40KB

.rsrc Size: 6KB - Virtual size: 34KB

.text
Size: 33KB - Virtual size: 32KB

.data
Size: 40KB - Virtual size: 40KB

.rsrc
Size: 6KB - Virtual size: 34KB