42641361def47b9ec92aadb44ef64acc0ba2f9ecb280da2ea192c109ac513de7N

General

Target

42641361def47b9ec92aadb44ef64acc0ba2f9ecb280da2ea192c109ac513de7N
Size

92KB
MD5

10aad6d94fa81239b7b8a1cf2cad4770
SHA1

34c1131e8d0cfe2948121a6b9cb62ca720e4f1ee
SHA256

42641361def47b9ec92aadb44ef64acc0ba2f9ecb280da2ea192c109ac513de7
SHA512

3e93712aea77c6d7b46ff9203c33a428f9ed13806b2364874f7b827ad2f919a220da9fff8693f6ca98b8d3900e9dc64b72bec175ae5b86e87689140414137258
SSDEEP

384:PPA1bJAFNFggGSfdoyfnCkZHaJR9vPA1bJzzihde7KnCkhEjOPH21MpKcAa0L:kqNM/yP5w9EV+XTQOPiKKX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42641361def47b9ec92aadb44ef64acc0ba2f9ecb280da2ea192c109ac513de7N

Files

42641361def47b9ec92aadb44ef64acc0ba2f9ecb280da2ea192c109ac513de7N
.exe windows:4 windows x86 arch:x86

106519fafd3ec017616d889f4e5b5436

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

klipopga.pdb

Imports

user32

DialogBoxParamW
CharToOemA
ShowWindow
IsDialogMessageA
CreateWindowExW
DispatchMessageA
SetCursorPos
GetWindowTextA
IsWindow
PeekMessageA
PostMessageA
GetCaretPos
wsprintfA
IsCharLowerA

kernel32

CopyFileA
SetEnvironmentVariableA
SleepEx
InterlockedExchange
CreateSemaphoreW
CreateMutexA
GetAtomNameA
GetNumberFormatA
GetCurrentProcess
GetConsoleAliasW
FormatMessageA
WriteProcessMemory
GetDateFormatW
FindResourceExA
CreateEventA
WriteFile
ExpandEnvironmentStringsA
GetSystemInfo
CreateDirectoryA
LoadLibraryA
GetPrivateProfileIntA
InterlockedDecrement
HeapCreate
GetProcessHeap
CloseHandle

crypt32

CertCompareCertificate
CertNameToStrA
CertDuplicateCRLContext
CertGetNameStringA
CryptEncodeObject
CryptEnumOIDInfo
CertFindChainInStore
CertFindAttribute
CertDuplicateStore
CertAlgIdToOID

upnphost

DllCanUnloadNow
DllGetClassObject
ServiceMain
DllRegisterServer

ctl3d32

Ctl3dCtlColor
Ctl3dUnregister
Ctl3dEnabled
Ctl3dRegister
Ctl3dGetVer

dbnmpntw

ConnectionClose
ConnectionError
ConnectionRead
ConnectionVer
ConnectionWrite

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

106519fafd3ec017616d889f4e5b5436

Headers

File Characteristics

PDB Paths

Imports

user32

kernel32

crypt32

upnphost

ctl3d32

dbnmpntw

Sections

.text Size: 52KB - Virtual size: 48KB

.data Size: 20KB - Virtual size: 16KB

.rsrc Size: 16KB - Virtual size: 12KB

.text
Size: 52KB - Virtual size: 48KB

.data
Size: 20KB - Virtual size: 16KB

.rsrc
Size: 16KB - Virtual size: 12KB