011ce3f456abbb1c932c8000b33da0037d9e7014d0077b6d7e1dab6512cd9fc0

Sharing

Copy URL

Twitter E-mail

General

Target

011ce3f456abbb1c932c8000b33da0037d9e7014d0077b6d7e1dab6512cd9fc0
Size

405KB
MD5

fbb86cabd07bc0e38b8b2d7295e01b33
SHA1

9e38c05dad3758e86c7231ad17ba1d5f290f1c4c
SHA256

011ce3f456abbb1c932c8000b33da0037d9e7014d0077b6d7e1dab6512cd9fc0
SHA512

887dff71f97059478d95ed0201b0f61f9093f06f5d40b37cd5ba053ec81402b722192595fec78f19a1daeeab5f2d4c0dbd97e2c17ae284d59c2645cbcca88ac4
SSDEEP

6144:RF60FrgU35YuXFJKb4gOFHYO5aHohQX6gBN5VBrYIBMHebg:RFDmMXPKb4xD5aHGQX665XrYIe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
011ce3f456abbb1c932c8000b33da0037d9e7014d0077b6d7e1dab6512cd9fc0

Files

011ce3f456abbb1c932c8000b33da0037d9e7014d0077b6d7e1dab6512cd9fc0
.exe windows:5 windows x86 arch:x86

e7bed300ceaeb8ec5f9a693bb74397c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jebexa\hiti\l.pdb

Imports

kernel32

GetSystemDefaultLangID
ExitProcess
InterlockedDecrement
GetModuleHandleW
GetTickCount
GetConsoleAliasesLengthA
SetFileTime
CreateActCtxW
GlobalAlloc
LoadLibraryW
GetConsoleMode
TerminateThread
GetVersionExW
IsBadWritePtr
FileTimeToSystemTime
LocalHandle
GetEnvironmentVariableA
CompareStringW
lstrlenW
SetCurrentDirectoryA
GetStartupInfoA
FindFirstFileExA
SetLastError
GetProcAddress
GetLongPathNameA
WriteProfileSectionA
CopyFileA
GlobalGetAtomNameA
SearchPathA
ProcessIdToSessionId
OpenWaitableTimerW
MoveFileA
WriteProfileSectionW
GetModuleFileNameA
GetOEMCP
FreeEnvironmentStringsW
GetCurrentDirectoryA
CompareStringA
OutputDebugStringA
SetProcessShutdownParameters
SetFileShortNameA
GetVersionExA
TlsAlloc
GetWindowsDirectoryW
DeleteFileW
AddConsoleAliasA
LocalFileTimeToFileTime
FlushFileBuffers
GetStartupInfoW
HeapValidate
IsBadReadPtr
RaiseException
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
InterlockedIncrement
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStdHandle
GetFileType
TlsGetValue
TlsSetValue
TlsFree
GetLastError
HeapDestroy
HeapCreate
HeapFree
VirtualFree
WriteFile
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
DebugBreak
WriteConsoleW
OutputDebugStringW
RtlUnwind
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
GetModuleHandleA

user32

GetAltTabInfoW

Sections

.text
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 41.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7bed300ceaeb8ec5f9a693bb74397c8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 301KB - Virtual size: 301KB

.data Size: 7KB - Virtual size: 41.3MB

.rsrc Size: 14KB - Virtual size: 14KB

.reloc Size: 81KB - Virtual size: 81KB

.text
Size: 301KB - Virtual size: 301KB

.data
Size: 7KB - Virtual size: 41.3MB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 81KB - Virtual size: 81KB