3534cc8899e06062d5776176b223f1ca

Sharing

Copy URL

Twitter E-mail

General

Target

3534cc8899e06062d5776176b223f1ca
Size

217KB
MD5

3534cc8899e06062d5776176b223f1ca
SHA1

18b15c35a74e244b516b9a4ecff8b0b890c5bd1e
SHA256

849f9f7c3482fc7e5da7b9cf809dfb9c93310bedd26138082932945fb66479c1
SHA512

5ad006ceab3d7af06cd18a1c66952850e22ce65910de648401edcb26ea0cc08ce72855dd33721ac1c07bf2009d53b7ee3b12ae9b5470bc3b5b1d987a0a4ae0a1
SSDEEP

1536:4N52bQKwd3oYg3beLzwvO7uSkFcS1s4npt53WKqV7F1yz8gzJerLS:4OMKuFPnHue4npt53q7F1yz8gA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
3534cc8899e06062d5776176b223f1ca

Files

3534cc8899e06062d5776176b223f1ca
.exe windows:5 windows x86 arch:x86

8787b0252dcb06c76986775432fa4f4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\tigixakeguc\zehinagugejic-yenolofaw.pdb

Imports

kernel32

GetCurrentProcess
SetDefaultCommConfigW
CreateJobObjectW
GetConsoleAliasesLengthA
CreateRemoteThread
GetEnvironmentStrings
LoadLibraryW
GetConsoleMode
GetBinaryTypeA
ReadFile
GetModuleFileNameW
SetConsoleTitleA
GetPrivateProfileIntW
InterlockedIncrement
GetLastError
GetProcAddress
GetLongPathNameA
MoveFileW
LoadLibraryA
LocalAlloc
CreateEventW
SetProcessWorkingSetSize
OpenJobObjectW
EnumCalendarInfoExA
SetFileAttributesW
lstrcpynA
FreeLibrary
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
HeapCreate
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
SetStdHandle
RtlUnwind
GetConsoleCP
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
IsProcessorFeaturePresent
HeapReAlloc
WriteConsoleW
MultiByteToWideChar
LCMapStringW
GetStringTypeW
CloseHandle
CreateFileW

gdi32

GetBitmapBits

winhttp

WinHttpCloseHandle

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 373KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ceh
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8787b0252dcb06c76986775432fa4f4b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

winhttp

Sections

.text Size: 117KB - Virtual size: 116KB

.data Size: 65KB - Virtual size: 373KB

.ceh Size: 3KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 24KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 117KB - Virtual size: 116KB

.data
Size: 65KB - Virtual size: 373KB

.ceh
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 24KB

.reloc
Size: 6KB - Virtual size: 5KB