f2d94107db385fae38b50dbf0af5c80b3062ca03ec1ae4d841978b622aaeb6b1

Sharing

Copy URL

Twitter E-mail

General

Target

f2d94107db385fae38b50dbf0af5c80b3062ca03ec1ae4d841978b622aaeb6b1
Size

323KB
MD5

86b011600e3403c0e707ce805715f63f
SHA1

ad1f1e3e8e4c2a06d73816753fc115c39d35ad18
SHA256

f2d94107db385fae38b50dbf0af5c80b3062ca03ec1ae4d841978b622aaeb6b1
SHA512

6a3a7ac95e0c7a904a4db857cb54f22bcaf125d9593873df47047fa38bf468f4f20d3828ea724f834744c1b29edc55211304478e4d8794f7ac3cce40bf108bf4
SSDEEP

6144:1awZ8ufAuk/hYUqxBiwI0tLEQvh4WKopqxsiDRW9vfb7ITsq0:ZZ8uXk/h0iuSQvh4WKopq7RWR7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2d94107db385fae38b50dbf0af5c80b3062ca03ec1ae4d841978b622aaeb6b1

Files

f2d94107db385fae38b50dbf0af5c80b3062ca03ec1ae4d841978b622aaeb6b1
.exe windows:5 windows x86 arch:x86

16daddd238d0a16baac8dce0ea4061f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\fasa\wama 4-hexilukew.pdb

Imports

kernel32

GlobalAddAtomA
CompareFileTime
WaitForSingleObject
WriteConsoleInputA
SetEvent
CreateHardLinkA
GetEnvironmentStrings
ActivateActCtx
GlobalAlloc
GetLocaleInfoW
SetVolumeMountPointA
GetProcessHandleCount
GetVersionExW
SetComputerNameExA
TerminateProcess
GetStringTypeExA
GetConsoleAliasesW
DeleteFiber
SetLastError
GetProcAddress
VirtualAlloc
HeapSize
LoadLibraryA
WriteConsoleA
GetExitCodeThread
ResetWriteWatch
EnumCalendarInfoExA
GetConsoleAliasW
GetLastError
HeapReAlloc
HeapAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
VirtualFree
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

advapi32

MapGenericMask

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bupah
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16daddd238d0a16baac8dce0ea4061f3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 223KB - Virtual size: 222KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 5KB - Virtual size: 3.9MB

.bupah Size: 1024B - Virtual size: 626B

.rsrc Size: 78KB - Virtual size: 78KB

.text
Size: 223KB - Virtual size: 222KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 5KB - Virtual size: 3.9MB

.bupah
Size: 1024B - Virtual size: 626B

.rsrc
Size: 78KB - Virtual size: 78KB