570fd1149c35dc3fac17102ef895ceab342e28b0cb3d8816d0ea20350c651558

Sharing

Copy URL Twitter E-mail

General

Target

570fd1149c35dc3fac17102ef895ceab342e28b0cb3d8816d0ea20350c651558
Size

131KB
MD5

32e47cc7ead585dbc691942773f7b7c3
SHA1

34e5444cdfc6bafb3009e4107542e02b51ec5c19
SHA256

570fd1149c35dc3fac17102ef895ceab342e28b0cb3d8816d0ea20350c651558
SHA512

855278b72390d78f72839177abb8958106a8d3c291e69a1c1370493c669ad97b043fb9093e022f54b9c87ec949ffdaebd697cbc3e1bfdb4c3fbbac9302cae9ed
SSDEEP

3072:grs3agYvUjkATavl7+wb6+jbWIIX1MuVyuUKEu:nJOz7RySyUKEu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
570fd1149c35dc3fac17102ef895ceab342e28b0cb3d8816d0ea20350c651558

Files

570fd1149c35dc3fac17102ef895ceab342e28b0cb3d8816d0ea20350c651558
.exe windows:5 windows x86 arch:x86

0947c7ff01200c15b2e65f7a0cb689a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxW

kernel32

WideCharToMultiByte
ReadFile
SetEndOfFile
InitializeCriticalSectionAndSpinCount
RaiseException
GetLastError
DecodePointer
DeleteCriticalSection
CreateProcessW
WaitForSingleObject
CloseHandle
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
CreateMutexA
GetModuleFileNameW
GetExitCodeProcess
CreateThread
CreateNamedPipeA
ConnectNamedPipe
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
HeapFree
EncodePointer
RtlUnwind
SetEvent
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetProcAddress
SetLastError
GetCurrentThread
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
ReadConsoleW
GetProcessHeap
GetStdHandle
GetFileType
GetStartupInfoW
WriteFile
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
HeapSize
HeapAlloc
GetThreadTimes
LoadLibraryExW
InitializeSListHead
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
FlushFileBuffers
GetStringTypeW
WriteConsoleW
CreateFileW

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0947c7ff01200c15b2e65f7a0cb689a9

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 6KB - Virtual size: 5KB