3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217

Sharing

Copy URL

Twitter E-mail

General

Target

3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217
Size

603KB
MD5

eb13533a89da9762d93de5d54966df5f
SHA1

c0d2cef9149395218eb3a91afe6cbbdbf0181c65
SHA256

3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217
SHA512

30c2bab2b0729bdc54797421c5e1611a2ff842a29815d3cf4da320efcc61c50a266f78a97df53a0f0a7c297393ab460b9795e9bc63f5c80cc2f31d75e6cda5fa
SSDEEP

12288:GBgmEvHIqBTQtTdfYBgfS/fIPgA3EFIpGXfQcytS2nF6hBq:GBgmEvHIq1J03EFEG9H2nEq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217

Files

3dc6902dc87d976787bdf0878e7174ec526df613645d3f275e0216d05cf2d217
.exe windows:6 windows x64 arch:x64

b5f1a1d1c89893764273d20e9396c5d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcmpW
GetLocalTime
GetCommandLineW
GetCurrentProcess
FindClose
SetEndOfFile
WriteConsoleW
HeapSize
CreateFileW
ReadConsoleW
lstrlenA
FindNextFileW
FindFirstFileExW
MoveFileExW
CloseHandle
GetLastError
GetModuleFileNameW
GetFileAttributesW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
HeapFree
HeapAlloc
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
RtlUnwind

user32

SystemParametersInfoW
wsprintfW
ExitWindowsEx

advapi32

AdjustTokenPrivileges
RegCloseKey
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
LookupPrivilegeValueW

shell32

CommandLineToArgvW
ShellExecuteW

ole32

CLSIDFromString

shlwapi

StrStrIW

gdiplus

GdipCreateFont
GdipCreateSolidFill
GdipGetGenericFontFamilySansSerif
GdipDrawString
GdipSetStringFormatLineAlign
GdipFillRectangleI
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipSetStringFormatAlign
GdipSaveImageToFile
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipDeleteBrush
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateStringFormat
GdipGetImageGraphicsContext

ws2_32

htons
WSAGetLastError

Sections

.text
Size: 473KB - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5f1a1d1c89893764273d20e9396c5d5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

gdiplus

ws2_32

Sections

.text Size: 473KB - Virtual size: 473KB

.rdata Size: 100KB - Virtual size: 99KB

.data Size: 8KB - Virtual size: 15KB

.pdata Size: 16KB - Virtual size: 16KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 473KB - Virtual size: 473KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 8KB - Virtual size: 15KB

.pdata
Size: 16KB - Virtual size: 16KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB