0c10aeccb9c1f4af3607da1d2163682b9311d90b860780f9b9f7b9808e936fde

Sharing

Copy URL

Twitter E-mail

General

Target

0c10aeccb9c1f4af3607da1d2163682b9311d90b860780f9b9f7b9808e936fde
Size

444KB
MD5

ff4d8a2bf99e2423a741e0d811831adc
SHA1

af488d1f549d1c05c21d661578607e08583de13d
SHA256

0c10aeccb9c1f4af3607da1d2163682b9311d90b860780f9b9f7b9808e936fde
SHA512

db7d00a0a600fa0fe81799828a612a1c9ab91dea0ad68c86e9d730ab7f3cddc7287d3501f38197621c165d7e28c8c5cd92dbdf0694e8541143c88212d680104d
SSDEEP

6144:JLUwbU1fvkN1WFmBVS/mb6SU0EOJ2fCiGJ:JXbUxU1LBNu5BOJ/J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c10aeccb9c1f4af3607da1d2163682b9311d90b860780f9b9f7b9808e936fde

Files

0c10aeccb9c1f4af3607da1d2163682b9311d90b860780f9b9f7b9808e936fde
.exe windows:5 windows x86 arch:x86

dbe848d8ef2efb5b33be00d897cafee0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\fisot61-pumufinezixica povibu\raboduh\pe.pdb

Imports

kernel32

FileTimeToDosDateTime
WriteConsoleInputW
GetLocaleInfoA
GetConsoleAliasA
GetCurrentActCtx
SetVolumeMountPointW
GetConsoleAliasesA
GetConsoleTitleA
FindResourceExA
GlobalAlloc
TerminateThread
GetVersionExW
GetWriteWatch
WriteConsoleW
ReplaceFileA
SetLastError
GetProcAddress
VirtualAlloc
GetComputerNameExW
HeapLock
OpenJobObjectW
GetModuleHandleA
GetStringTypeW
ReleaseMutex
EnumCalendarInfoExA
SwitchToThread
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetLastError
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
WideCharToMultiByte
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA

winhttp

WinHttpCrackUrl

Sections

.text
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gunu
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbe848d8ef2efb5b33be00d897cafee0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

winhttp

Sections

.text Size: 394KB - Virtual size: 393KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 3.9MB

.gunu Size: 1024B - Virtual size: 626B

.rsrc Size: 35KB - Virtual size: 35KB

.text
Size: 394KB - Virtual size: 393KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 3.9MB

.gunu
Size: 1024B - Virtual size: 626B

.rsrc
Size: 35KB - Virtual size: 35KB