27920800622a9cecd457560746dede9e3a5133e477bc56756e488253c2a65dceN

General

Target

27920800622a9cecd457560746dede9e3a5133e477bc56756e488253c2a65dceN
Size

208KB
MD5

82261f9bf806d0c92c6c392c0fe21eb0
SHA1

e2539336c17fe481a39d43bcfd5e90e6c58f8509
SHA256

27920800622a9cecd457560746dede9e3a5133e477bc56756e488253c2a65dce
SHA512

e42fd053f5f1db5cf1a9260a97553c96fff6d4b6bc815cdab9b433ea4b814481d6e90540fa0df39eaa540bf59d26450e8ca8574a46abd3b3b8cefd83bf66965f
SSDEEP

3072:23pRmF4qOF04PkWYmsMtiL76PerRhOs7dEMjIV89ozBzy0LymWqml9ViPzOdk5au:232F4yssy/WtMMjIzBy4WqH6kh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27920800622a9cecd457560746dede9e3a5133e477bc56756e488253c2a65dceN

Files

27920800622a9cecd457560746dede9e3a5133e477bc56756e488253c2a65dceN
.exe windows:4 windows x86 arch:x86

e8a99fc532414ae756ce08b45dd4f636

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegReplaceKeyA
LsaRetrievePrivateData
RegRestoreKeyA
RegNotifyChangeKeyValue
RegLoadKeyA
ObjectOpenAuditAlarmA
GetOldestEventLogRecord
ObjectDeleteAuditAlarmA
RegQueryInfoKeyA
AccessCheck
LsaEnumerateAccountRights
LsaQueryInformationPolicy

kernel32

FlushViewOfFile
CreateMutexA
ClearCommBreak
GlobalSize
FatalExit
EnumCalendarInfoW
FindResourceW
CallNamedPipeA
CloseHandle
EnumDateFormatsA
GetModuleHandleA
GetStartupInfoA

msvcrt

_open
_controlfp
_exit
__p__fmode
__p__commode
_adjust_fdiv
__set_app_type
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_c_exit

user32

DdeQueryStringA
GetClipCursor
ToUnicodeEx
GetActiveWindow
BlockInput
GetClipboardFormatNameA
SubtractRect
EmptyClipboard
GetKeyboardLayout
DdeCreateDataHandle
DdeQueryNextServer
CharLowerA
GetDlgItemInt
GetForegroundWindow
IsClipboardFormatAvailable
SetKeyboardState
ChangeDisplaySettingsExA
GetKeyState
GetProcessWindowStation
GetOpenClipboardWindow
LoadStringA
OpenInputDesktop
CharPrevA
BeginDeferWindowPos
GetKBCodePage

version

GetFileVersionInfoW

rasapi32

RasGetEntryPropertiesA
RasEditPhonebookEntryW
RasGetConnectStatusW
RasSetEntryDialParamsA
RasDialW
RasDialA

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8a99fc532414ae756ce08b45dd4f636

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

version

rasapi32

Sections

.text Size: 24KB - Virtual size: 20KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 160KB - Virtual size: 3.0MB

.rsrc Size: 12KB - Virtual size: 8KB

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 160KB - Virtual size: 3.0MB

.rsrc
Size: 12KB - Virtual size: 8KB