1af4fa119a2dedb3b84b2de1e0d8b231fab7afd98272206075281974c30581fbN

Sharing

Copy URL

Twitter E-mail

General

Target

1af4fa119a2dedb3b84b2de1e0d8b231fab7afd98272206075281974c30581fbN
Size

54KB
MD5

ff724bc4eabd55e09128abb8723f6490
SHA1

4414a76a0178ebf266d0ea9520827283ad787b37
SHA256

1af4fa119a2dedb3b84b2de1e0d8b231fab7afd98272206075281974c30581fb
SHA512

f8650768029cb063c285beef8cb7ab6cadfc11ef125dd736b1d750afff7a507669ef3c72567d18dddc10d0f796c7120d100e3dd02d0892eec3e2fa3c69fcee12
SSDEEP

768:GcPlBb5RE2NU72Zbc9hd42XiAARGjlTEQzQ:vlB8202ZgLd42Xi70ZEsQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1af4fa119a2dedb3b84b2de1e0d8b231fab7afd98272206075281974c30581fbN

Files

1af4fa119a2dedb3b84b2de1e0d8b231fab7afd98272206075281974c30581fbN
.exe windows:5 windows x86 arch:x86

ff75cf6ebe647d613067e9094a5d0cdc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

iisrstas.pdb

Imports

msvcrt

__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__initenv
__p__fmode
??2@YAPAXI@Z
_controlfp
exit
_cexit
_XcptFilter
_exit
_c_exit
wcscmp
_wcsicmp
wcslen
__p__commode
_purecall
free
_wtol
iswctype
??3@YAXPAX@Z
_except_handler3
__set_app_type
malloc
_strcmpi

atl

ord16
ord21
ord23
ord17
ord20
ord32
ord58
ord30

advapi32

InitiateSystemShutdownExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatusEx
RegQueryValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenSCManagerW
QueryServiceConfigW
StartServiceW
QueryServiceStatus
GetTokenInformation
LookupAccountSidW
OpenServiceW
EnumDependentServicesW
CloseServiceHandle
ControlService
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
MakeSelfRelativeSD
RegSetValueExW
RegOpenKeyExW
RegCloseKey

kernel32

Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
LoadLibraryW
GetProcAddress
FreeLibrary
FormatMessageW
LocalAlloc
GetTickCount
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
GetModuleHandleW
GetCurrentThreadId
LocalFree
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
InterlockedDecrement
InterlockedIncrement
GetLastError
GetCurrentProcess
CloseHandle
OpenProcess
TerminateProcess
lstrcmpiW
lstrlenW
lstrcpyW
ReadProcessMemory
InitializeCriticalSection
DeleteCriticalSection

user32

GetMessageW
DispatchMessageW
CharNextW
PostThreadMessageW
wsprintfA
EnumWindows
wsprintfW
GetWindowThreadProcessId
GetWindowTextW
PostMessageW

ole32

CoInitializeSecurity
CoUninitialize
CoInitializeEx

oleaut32

SysStringLen
SysFreeString
LoadRegTypeLi

ntdll

NtQueryInformationProcess

iisutil

SetExplicitAccessSettings
AllocateAndCreateWellKnownSid
FreeWellKnownSid

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ff75cf6ebe647d613067e9094a5d0cdc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

atl

advapi32

kernel32

user32

ole32

oleaut32

ntdll

iisutil

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 34KB - Virtual size: 35KB

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 34KB - Virtual size: 35KB