e48d72498ec14ff12699b41c70b8499a7b702cf1f6f1bd6e46d2a1d5d4518af1

General

Target

e48d72498ec14ff12699b41c70b8499a7b702cf1f6f1bd6e46d2a1d5d4518af1
Size

47KB
MD5

1895c811f79eb24751b88b13f6180683
SHA1

c06e5e26ed0e948e778e565470c6b401b6d6dfee
SHA256

e48d72498ec14ff12699b41c70b8499a7b702cf1f6f1bd6e46d2a1d5d4518af1
SHA512

d49198f314dee3d76ce98b1033b9b3e6f4596383b61bde3134adb69dbf37277bf4dac2ca145751f1824fd631693877c9bc44229a09672a6bafca93b15fcd5447
SSDEEP

768:e0tVUb2MGXtN2dKRGKpjpMBAyCbF+42qg:xhpOdKRGKpjbyo+4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e48d72498ec14ff12699b41c70b8499a7b702cf1f6f1bd6e46d2a1d5d4518af1

Files

e48d72498ec14ff12699b41c70b8499a7b702cf1f6f1bd6e46d2a1d5d4518af1
.exe windows:5 windows x86 arch:x86

eae9b244a5321f7bd1158ea3ab83f687

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

WinXPChk.pdb

Imports

kernel32

LocalFree
FormatMessageA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetVersion
CloseHandle
CreateProcessA
GetPrivateProfileStringA
SetCurrentDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
GetModuleHandleA
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsFree
SetLastError
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo

user32

MessageBoxA

shlwapi

PathAppendA
PathFileExistsA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

eae9b244a5321f7bd1158ea3ab83f687

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shlwapi

Sections

.text Size: 23KB - Virtual size: 22KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 11KB - Virtual size: 29KB

.text
Size: 23KB - Virtual size: 22KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 11KB - Virtual size: 29KB