986d6f67af986d7e382092b63cd30d99afd1ab50913a00af90d6bc0a676caf95

Sharing

Copy URL Twitter E-mail

General

Target

986d6f67af986d7e382092b63cd30d99afd1ab50913a00af90d6bc0a676caf95
Size

68KB
MD5

6aceab7766c1c5b4a8a026ed2a7934b5
SHA1

00ebc16a5c155974c0eaf1cacfbcd438b14bb562
SHA256

986d6f67af986d7e382092b63cd30d99afd1ab50913a00af90d6bc0a676caf95
SHA512

7368e094e59ebb71303a56971b785904f7a4392ab74122515749e1f741a2f66a225905e8593abd062b68b3dbb3968f9a7d397e862f5e189f6a4a9cbd0f283ff9
SSDEEP

768:RGj+kEdzf7FnxmsyL6dMffa3qpqmRB1EHMNxuOit0WXCjUwGU:RakTxxZGJpqmFEsNxuOaCjUwGU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
986d6f67af986d7e382092b63cd30d99afd1ab50913a00af90d6bc0a676caf95

Files

986d6f67af986d7e382092b63cd30d99afd1ab50913a00af90d6bc0a676caf95
.exe .vbs windows:4 windows x86 arch:x86 polyglot

932fe753a047b7925e098ba1cf324eeb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strncpy
malloc
free
modf
tolower
toupper
??3@YAXPAX@Z
strncmp
??2@YAPAXI@Z
_ftol
atoi
sprintf
_strnicmp

user32

SetTimer
MsgWaitForMultipleObjects
GetClassNameA
RegisterWindowMessageA
SendMessageTimeoutA
FindWindowExA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA

kernel32

SetFileAttributesA
GetFileSize
ReadFile
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
SetWaitableTimer
CreateWaitableTimerA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
DeleteFileA
Process32Next
WriteFile
MoveFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
CreateProcessA
OpenEventA
CreateEventA
SetProcessWorkingSetSize
CreateToolhelp32Snapshot
Process32First
CloseHandle
CreateFileA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

oleacc

ObjectFromLresult

shlwapi

PathFileExistsA

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize

oleaut32

SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayAccessData
VarR8FromBool
LoadTypeLi
RegisterTypeLi
SafeArrayCreate
SysAllocString
VarR8FromCy
VariantClear
SafeArrayDestroy
VariantChangeType
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

932fe753a047b7925e098ba1cf324eeb

Headers

File Characteristics

Imports

msvcrt

user32

kernel32

shell32

oleacc

shlwapi

ole32

oleaut32

Sections

.text Size: 52KB - Virtual size: 50KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 804B

.text
Size: 52KB - Virtual size: 50KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 804B