347aea80faebcb163ef3c1bd141b40ec3b2d2a44d76d9aaa3d21cb895f47d8e3

Sharing

Copy URL Twitter E-mail

General

Target

347aea80faebcb163ef3c1bd141b40ec3b2d2a44d76d9aaa3d21cb895f47d8e3
Size

616KB
MD5

99098f91e42bf442d5bb93a5e26c5acb
SHA1

2f702391422f44fa07539e7ab1dd47ec3661bf3f
SHA256

347aea80faebcb163ef3c1bd141b40ec3b2d2a44d76d9aaa3d21cb895f47d8e3
SHA512

a4b23ef14c8cf4cf3f3cc5a1f940a02db61a4ab68a9df365a50762fa73914a13e7291cd549db44a9b0734f50c93c8342d20aa43767161793573a23c061524506
SSDEEP

12288:pKxAdUXoBK+W9XH6Hiqt5hDCS5W1/It2ZyrJPMoJjc2NBmOow8x:pGGUX1+WNGiq3hWSo1/hyFHOxx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
347aea80faebcb163ef3c1bd141b40ec3b2d2a44d76d9aaa3d21cb895f47d8e3

Files

347aea80faebcb163ef3c1bd141b40ec3b2d2a44d76d9aaa3d21cb895f47d8e3
.dll windows:4 windows x86 arch:x86

a35d843d0789147d6fc4a653b2cafdc3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleExA
VirtualFreeEx
VirtualAlloc
GetModuleHandleA
GetProcAddress
lstrcpynA
RtlMoveMemory
LoadLibraryA
VirtualFree
GetProcessHeap
ExitProcess
HeapAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CloseHandle
ReadFile
GetFileSize
CreateFileA
FreeLibrary

user32

wsprintfA
MessageBoxA

msvcrt

strchr
sprintf
modf
floor
_ftol
atoi

Exports

Exports

GetCurrentInternal_EnableTelemetry
GetCurrentInternal_GetConfigurationReport
GetCurrent_IsUpgradeOptionSupported
GetCurrent_IsWindowsLicensed
GetCurrent_MinimalRequirementCheck
GetCurrent_SetGetCurrentFlagFile
GetCurrent_SetMigrationOption
GetCurrent_SetPartnerID
GetCurrent_SetPartnerPostOOBEScript
GetCurrent_SetReportFunc
GetCurrent_SetReportFuncEx
GetCurrent_SetRollbackCmdLine
GetCurrent_SetSourcePath
GetCurrent_SetSourcePathEx
GetCurrent_SetUpgradeOptionType
GetCurrent_ShowActivationUI
GetCurrent_StartDeploy
GetCurrent_SyncData
GetCurrent_SyncDataEx

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dzdun0
Size: 572KB - Virtual size: 569KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a35d843d0789147d6fc4a653b2cafdc3

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 51KB

dzdun0 Size: 572KB - Virtual size: 569KB

.reloc Size: 4KB - Virtual size: 1016B

.rsrc Size: 4KB - Virtual size: 1012B

.text
Size: 24KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 51KB

dzdun0
Size: 572KB - Virtual size: 569KB

.reloc
Size: 4KB - Virtual size: 1016B

.rsrc
Size: 4KB - Virtual size: 1012B