c72ae6edeaced41fa9bef01881b66879ffdfcb3b5d37242e5f404d57bde32f73

Sharing

Copy URL

Twitter E-mail

General

Target

c72ae6edeaced41fa9bef01881b66879ffdfcb3b5d37242e5f404d57bde32f73
Size

95KB
MD5

05378908bcf50add759a9b32450264fe
SHA1

d9bd3ba4aeb2f63bfa7248cd0b473d68cf34f827
SHA256

c72ae6edeaced41fa9bef01881b66879ffdfcb3b5d37242e5f404d57bde32f73
SHA512

5775f882c271797e9706cded486e399fc9ba139e3f751ee8da5ee5290ed286649617624d9ae0b37b085f116df33b4a0947041d296f4703343ea174b33f30009d
SSDEEP

1536:EKVjzRaCiS4xh4VeZE8RcDAHwDTUri1RyX6tE4V0ew29nWpKLeA+mMxriO8rRMFY:tDaCirUePcDswDorirgWVw0nWsL/Mx3G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7f93859a1333e40574f822b1c7d5889b5ba982dfef94863f4190af931373aa18

Files

c72ae6edeaced41fa9bef01881b66879ffdfcb3b5d37242e5f404d57bde32f73
.zip

Password: infected
7f93859a1333e40574f822b1c7d5889b5ba982dfef94863f4190af931373aa18
.exe windows:5 windows x86 arch:x86

2d072324798956717a479868e71b5c9d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\zixuwod_betenasa70 yufikelul.pdb

Imports

kernel32

LoadResource
HeapAlloc
SetMailslotInfo
SetEnvironmentVariableW
GetEnvironmentStringsW
SetEvent
FlushConsoleInputBuffer
GetTickCount
TlsSetValue
GlobalAlloc
SetConsoleCursorPosition
WriteConsoleW
GetModuleFileNameW
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
PrepareTape
GetAtomNameA
LoadLibraryA
WriteConsoleA
FindFirstChangeNotificationA
GetProcessAffinityMask
AddConsoleAliasA
FindNextVolumeA
CreateFileW
GetProcessHeap
DecodePointer
EncodePointer
GetModuleHandleW
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetLastError
SetFilePointer
TlsAlloc
TlsGetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapFree
CloseHandle
LoadLibraryW
WriteFile
FreeEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
ReadFile
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
CreateFileA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
RaiseException
MultiByteToWideChar
HeapReAlloc
LCMapStringW
GetStringTypeW
SetEndOfFile

user32

SetCursorPos

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rafe
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

2d072324798956717a479868e71b5c9d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 6KB - Virtual size: 36KB

.rafe Size: 1024B - Virtual size: 626B

.rsrc Size: 26KB - Virtual size: 26KB

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 6KB - Virtual size: 36KB

.rafe
Size: 1024B - Virtual size: 626B

.rsrc
Size: 26KB - Virtual size: 26KB