0c9a24a17dd703c61e4c9547481d4332a48b2fc74382de306bc6fa42b19a5bb9

Sharing

Copy URL Twitter E-mail

General

Target

0c9a24a17dd703c61e4c9547481d4332a48b2fc74382de306bc6fa42b19a5bb9
Size

1.1MB
MD5

092ff632521d02bd50cb29e537cacf37
SHA1

079b986d0756db0b1fc4441ba2efd72b36c89ea3
SHA256

0c9a24a17dd703c61e4c9547481d4332a48b2fc74382de306bc6fa42b19a5bb9
SHA512

95c2ae99a1c25d696bdbc04f13fb0887b8859470f7e2f8ec4b01047ecb16994ff9bf94f299093d838e5ebf5c2f18bd49cb6d7fd6cb2784cdc8401795c4bae03d
SSDEEP

24576:q8dGzMTHYPBfjPrHxoNkPRHIDjba593nbA5xl:JdtT4ZfHeNURIDjbo93nbixl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c9a24a17dd703c61e4c9547481d4332a48b2fc74382de306bc6fa42b19a5bb9

Files

0c9a24a17dd703c61e4c9547481d4332a48b2fc74382de306bc6fa42b19a5bb9
.exe windows:4 windows x86 arch:x86

d29721bb1692d408a10571c2012efc0d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
lstrcpynA
lstrcpyA
GetCurrentProcessId
GetLocalTime
CloseHandle
TerminateProcess
OpenProcess
ReadFile
SetFilePointer
GetFileSize
CreateFileA
FindFirstFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetVersion
WaitForSingleObject
CreateProcessA
WriteFile
GetTempPathA
lstrlenA
GetFileType
GetCurrentThreadId
FindClose
GetModuleFileNameA
LoadLibraryExA
IsBadReadPtr
GetSystemInfo
VirtualAlloc
GetCurrentProcess
VirtualProtect
FreeLibrary
VirtualProtectEx
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetTickCount
VirtualFree
QueryPerformanceCounter
GlobalMemoryStatus
GetLastError
CreateEventA
ResetEvent
GetLogicalDriveStringsA
GetDriveTypeA
SetErrorMode
GetDiskFreeSpaceA
DeviceIoControl
FormatMessageA
LocalFree
ReleaseSemaphore
CreateSemaphoreA
CreateThread
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetVersionExA

user32

GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
wsprintfA
MessageBoxA
SetCursor
LoadCursorA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

msvcrt

malloc
_pctype
__mb_cur_max
_isctype
realloc
memchr
fwrite
fflush
_setmode
ftell
fseek
fgets
abort
wcsstr
_vsnprintf
vfprintf
_iob
qsort
fprintf
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
_ltoa
free
calloc
fputc
exit
strlen
??3@YAXPAX@Z
srand
rand
??2@YAPAXI@Z
mktime
localtime
strrchr
strcat
fopen
fread
fclose
memcmp
time
memmove
memset
strcmp
memcpy
_strnicmp
fgetc
_fileno

advapi32

ReportEventA
DeregisterEventSource
RegisterEventSourceA

Exports

Exports

_YtWriteUpdateDate@24

Sections

.text
Size: 236KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 768KB - Virtual size: 805KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d29721bb1692d408a10571c2012efc0d

Headers

File Characteristics

Imports

kernel32

user32

setupapi

msvcrt

advapi32

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 234KB

.rdata Size: 64KB - Virtual size: 62KB

.data Size: 768KB - Virtual size: 805KB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 236KB - Virtual size: 234KB

.rdata
Size: 64KB - Virtual size: 62KB

.data
Size: 768KB - Virtual size: 805KB

.rsrc
Size: 8KB - Virtual size: 4KB