58195ded048a529b594c7c15cba762aa6052ac34e074e9b9650461a1df824bbd

Sharing

Copy URL

Twitter E-mail

General

Target

58195ded048a529b594c7c15cba762aa6052ac34e074e9b9650461a1df824bbd
Size

140KB
MD5

66ed05c260b08f0f8ff255bbf088aeaa
SHA1

4c49ce1dbc0b235771e90dd4eb0caecf4ad294bc
SHA256

58195ded048a529b594c7c15cba762aa6052ac34e074e9b9650461a1df824bbd
SHA512

5fdecfbd83dfebfbb25dec16fdf0559f252f7d46e4a14fc9fa6ba9ff87e74efc8330e6de60ecbf7cae3425c63adc414dc5535d8a124239243d5adf261edd0733
SSDEEP

3072:hkEvx3l6xO3EGFdDgUNS5stO7J0xNdhrWur8gRrlL:WapT3EmdDDNS5+O7wRrNr8SlL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce

Files

58195ded048a529b594c7c15cba762aa6052ac34e074e9b9650461a1df824bbd
.zip
f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce
.exe windows:5 windows x86 arch:x86

7b9daca6da068f54ad4e1900288e8efd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\duf nuyibu\yeviraxeneg\rebimohec wefezemibev\pas\73-cimila.pdb

Imports

kernel32

SetFileApisToOEM
SetHandleCount
RequestWakeupLatency
GetConsoleAliasA
GetModuleHandleA
CreateDirectoryExW
GetLogicalDriveStringsW
ReadConsoleInputA
FindNextVolumeMountPointA
SearchPathA
CopyFileExA
CallNamedPipeW
GetCurrentDirectoryW
GetSystemDirectoryA
CreateMailslotW
TlsGetValue
GetProcAddress
LocalAlloc
GetCommandLineW
InterlockedIncrement
ConvertDefaultLocale
GetConsoleMode
FindFirstVolumeW
LocalFree
LocalFlags
InterlockedDecrement
ExitProcess
GetCurrencyFormatW
BuildCommDCBAndTimeoutsW
CreateActCtxA
GetConsoleAliasesLengthA
GetPrivateProfileIntA
_lread
SetVolumeMountPointW
EnumResourceLanguagesW
LoadModule
lstrlenW
CreateDirectoryA
GlobalFindAtomW
CopyFileW
VerSetConditionMask
CreateMutexW
DeactivateActCtx
GetDiskFreeSpaceA
MoveFileW
GetLogicalDriveStringsA
SetEvent
MoveFileExW
OpenMutexA
FindResourceW
SetFileTime
SetFilePointer
FindFirstFileA
EnumResourceLanguagesA
FreeEnvironmentStringsA
InterlockedCompareExchange
InterlockedExchangeAdd
GetModuleHandleW
SetLastError
GetLogicalDrives
EnumDateFormatsW
OpenMutexW
OpenJobObjectW
LoadLibraryA
HeapAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
Sleep
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetStartupInfoA
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
WideCharToMultiByte
GetConsoleCP
FlushFileBuffers
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA

gdi32

GetBrushOrgEx

advapi32

InitiateSystemShutdownW

winhttp

WinHttpWriteData

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b9daca6da068f54ad4e1900288e8efd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

advapi32

winhttp

Sections

.text Size: 51KB - Virtual size: 51KB

.data Size: 85KB - Virtual size: 223KB

.rsrc Size: 94KB - Virtual size: 93KB

.text
Size: 51KB - Virtual size: 51KB

.data
Size: 85KB - Virtual size: 223KB

.rsrc
Size: 94KB - Virtual size: 93KB