a5bdda3078b0d9b45576b00512837af9a0bd1de68bb3fcf754e9b21f21ecb6a1

Sharing

Copy URL Twitter E-mail

General

Target

a5bdda3078b0d9b45576b00512837af9a0bd1de68bb3fcf754e9b21f21ecb6a1
Size

677KB
MD5

207f574095878fafd33051ddf93a05eb
SHA1

fd9644000237e956d8fdf2389dbeaeb80de32649
SHA256

a5bdda3078b0d9b45576b00512837af9a0bd1de68bb3fcf754e9b21f21ecb6a1
SHA512

c5842c392c343405758cbe4bb6ba42c637f733c363c3cd7d69d707fa7fa601491790d98a7e42248cc005428fc1acb8014e8132242869e57b0b32237f4e54d7e4
SSDEEP

12288:UZ5T++8SLePnpKYtrotTnboW7d8JCxtu:UZ5+SaPpZtrIhWAD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5bdda3078b0d9b45576b00512837af9a0bd1de68bb3fcf754e9b21f21ecb6a1

Files

a5bdda3078b0d9b45576b00512837af9a0bd1de68bb3fcf754e9b21f21ecb6a1
.exe windows:6 windows x64 arch:x64

e8f4c47b37beb9f7f7ec79df970f8396

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlPcToFileHeader
RtlNtStatusToDosError
ZwSetIoCompletion
RtlAdjustPrivilege
NtQueryObject
NtQueryInformationProcess
RtlUnwindEx
RtlUnwind

wininet

InternetCloseHandle
InternetOpenUrlW
InternetReadFile
InternetOpenW

shell32

ShellExecuteW

kernel32

CompareStringW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
SetEndOfFile
FindFirstFileExW
FindClose
HeapReAlloc
GetTimeZoneInformation
SetFilePointerEx
GetCurrentProcess
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetTickCount
GetModuleFileNameA
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLastError
LocalFree
FormatMessageA
CreateFileW
WriteFile
DuplicateHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetProcAddress
ReadConsoleW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
ReadFile
GetConsoleMode
GetConsoleCP
RaiseException
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetACP
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
WriteConsoleW

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8f4c47b37beb9f7f7ec79df970f8396

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

wininet

shell32

kernel32

Sections

.text Size: 333KB - Virtual size: 333KB

.rdata Size: 131KB - Virtual size: 130KB

.data Size: 8KB - Virtual size: 15KB

.pdata Size: 14KB - Virtual size: 14KB

.rsrc Size: 184KB - Virtual size: 184KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 333KB - Virtual size: 333KB

.rdata
Size: 131KB - Virtual size: 130KB

.data
Size: 8KB - Virtual size: 15KB

.pdata
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 184KB - Virtual size: 184KB

.reloc
Size: 4KB - Virtual size: 4KB