4bb4fa71475b7843f65d839cf8ffaacba519f740c7a3080fc103576873f89458N

Sharing

Copy URL Twitter E-mail

General

Target

4bb4fa71475b7843f65d839cf8ffaacba519f740c7a3080fc103576873f89458N
Size

64KB
MD5

cf134a3766fa0e6121843839825e3650
SHA1

5d9741acb67748faadd6883e6fa160e2a194a569
SHA256

4bb4fa71475b7843f65d839cf8ffaacba519f740c7a3080fc103576873f89458
SHA512

fee7447b48e383c935f8c7b85ecc70576cbb1d16dbaa22fb71dca36ff166705646e232111f25fdb24dc6a79253f3a6675943e0f41739c615e1ef24f55e15808a
SSDEEP

768:B3EnbysEZQpMXR99BNYWnGcbmFrZapjPEBjAZf1NTRkTStZCAd4JdE0bOsiBxiMp:BNypMXT98WnXCapjPwYTmTiZCrPG68

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bb4fa71475b7843f65d839cf8ffaacba519f740c7a3080fc103576873f89458N

Files

4bb4fa71475b7843f65d839cf8ffaacba519f740c7a3080fc103576873f89458N
.exe windows:6 windows x86 arch:x86

79279d2cf4bef07b664082b428392225

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

relog.pdb

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

kernel32

WriteConsoleW
GetConsoleOutputCP
HeapFree
GetProcessHeap
GetLastError
GetConsoleScreenBufferInfo
GetFileType
GetStdHandle
SetConsoleTextAttribute
HeapAlloc
LocalFree
WriteFile
FormatMessageW
GetLocaleInfoW
GetModuleHandleW
GetModuleFileNameW
ReadConsoleW
ReadConsoleInputW
MultiByteToWideChar
ReadFile
SetConsoleMode
GetConsoleMode
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
FreeLibrary
LoadLibraryW
GetTempPathW
CloseHandle
CreateFileW
SetThreadUILanguage
DeleteFileW
CopyFileW
FileTimeToSystemTime
HeapSetInformation
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

msvcrt

__wgetmainargs
_cexit
_exit
_XcptFilter
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_controlfp
wcsncmp
_vsnwprintf
_wcsicmp
fwprintf
wprintf
_wcslwr
exit
_wtoi
fclose
wcstok
fgetws
_wfopen
memset
_wcsnicmp
wcstod
_ftol2
memcpy
wcsstr
_wsplitpath_s
_wmakepath_s
wcschr
_getmbcp

ole32

StringFromGUID2

user32

LoadStringW
CharToOemW

pdh

PdhRelogW
PdhGetLogFileTypeW
PdhOpenQueryH
PdhGetDataSourceTimeRangeH
PdhCloseLog
PdhBindInputDataSourceW
PdhEnumObjectItemsHW
PdhValidatePathExW
PdhParseCounterPathW
PdhMakeCounterPathW
PdhExpandWildCardPathHW
PdhEnumMachinesHW
PdhEnumObjectsHW
PdhAddCounterW

version

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

rpcrt4

UuidCreate

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

79279d2cf4bef07b664082b428392225

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ole32

user32

pdh

version

rpcrt4

Sections

.text Size: 29KB - Virtual size: 29KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 29KB - Virtual size: 30KB

.text
Size: 29KB - Virtual size: 29KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 29KB - Virtual size: 30KB