7e9e0dc3350d6b1140877cc869474c21a7092da10d0f77ee4dd4499f53d8081aN

Sharing

Copy URL Twitter E-mail

General

Target

7e9e0dc3350d6b1140877cc869474c21a7092da10d0f77ee4dd4499f53d8081aN
Size

90KB
MD5

a5f4fcc306c14f32cde60f92704762c0
SHA1

f4e777457b94109fb494be9db025eb3d33aa543d
SHA256

7e9e0dc3350d6b1140877cc869474c21a7092da10d0f77ee4dd4499f53d8081a
SHA512

a23a3698798638dd36d310b1463c2828e0e66a0178fe784bfd39ea1e29992063fec74edcee3f746be3bd1015b9753f42f99e44025600c69f6e54bf2991a3d280
SSDEEP

1536:ilkHzppKEeUdEqewNk9zc6RYRqEblBtOoYBEtPuV2iMjyDEUe1a8YHre:KYCEZFKFnYbjtOoYB6PuV2ihEXvYHa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e9e0dc3350d6b1140877cc869474c21a7092da10d0f77ee4dd4499f53d8081aN

Files

7e9e0dc3350d6b1140877cc869474c21a7092da10d0f77ee4dd4499f53d8081aN
.exe windows:5 windows x86 arch:x86

334d774587bd648c0c211ffe7cb912ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

macfile.pdb

Imports

kernel32

GetDiskFreeSpaceA
LocalFree
FormatMessageA
LocalAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
ExitProcess
GetProcAddress
GetModuleHandleA
GetLastError
MultiByteToWideChar
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetCPInfo
Sleep
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
LoadLibraryA
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo
SetFilePointer
FlushFileBuffers
GetLocaleInfoW
SetStdHandle
CloseHandle

sfmapi

AfpAdminDisconnect
AfpAdminBufferFree
AfpAdminVolumeAdd
AfpAdminDirectoryGetInfo
AfpAdminConnect
AfpAdminVolumeDelete
AfpAdminConnectionClose
AfpAdminConnectionEnum
AfpAdminVolumeGetInfo
AfpAdminVolumeSetInfo
AfpAdminServerSetInfo
AfpAdminDirectorySetInfo
AfpAdminFinderSetInfo

user32

CharToOemA

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

334d774587bd648c0c211ffe7cb912ed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

sfmapi

user32

Sections

.text Size: 45KB - Virtual size: 45KB

.data Size: 3KB - Virtual size: 10KB

.rsrc Size: 40KB - Virtual size: 43KB

.text
Size: 45KB - Virtual size: 45KB

.data
Size: 3KB - Virtual size: 10KB

.rsrc
Size: 40KB - Virtual size: 43KB