9346db463b22993fa161847c18d3d67281923070a71b247ba23e9856e1897fda

Sharing

Copy URL

Twitter E-mail

General

Target

9346db463b22993fa161847c18d3d67281923070a71b247ba23e9856e1897fda
Size

268KB
MD5

565ab49bb6db7cc1bc3dda2af5ca0a74
SHA1

86359720791e2758ded0e2762b6277b6c1cb60a6
SHA256

9346db463b22993fa161847c18d3d67281923070a71b247ba23e9856e1897fda
SHA512

828dd085327991e248cb61528355b0cbaebf17a473972a559dc4ca748d3f5fe29c4d5a4068607dc10c045055fa5b93f9e6348151c9dc4518533d14f5ae1644db
SSDEEP

6144:84/ESEj+zltRAPBoixClFDK6PCLcpn0RiI7+0HKCX6RP:8RSEixeBoB5Can0RiIsP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c7bf25b6d5ca9ed4161b083f6b13f4abd41aabb5312a878e3c3b18d5550bb2d5

Files

9346db463b22993fa161847c18d3d67281923070a71b247ba23e9856e1897fda
.zip
c7bf25b6d5ca9ed4161b083f6b13f4abd41aabb5312a878e3c3b18d5550bb2d5
.exe windows:5 windows x86 arch:x86

1c1060cdad929497670e465299b2bd1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\xepoholeg39_bitibozoxirapi\tig44_wegi\potok.pdb

Imports

kernel32

GetConsoleAliasesLengthW
GetLocaleInfoA
GetStringTypeA
CommConfigDialogA
FindResourceExW
InterlockedIncrement
GetConsoleAliasA
GetCurrentActCtx
WriteConsoleInputA
SetEvent
ReadConsoleW
SetFileTime
ActivateActCtx
GlobalAlloc
ReadConsoleInputA
ReadFileScatter
GetVersionExW
GetFileAttributesA
GetWriteWatch
WriteConsoleW
GetModuleFileNameW
SetComputerNameExW
CreateActCtxA
ReleaseSemaphore
SetConsoleTitleA
GetLastError
GetProcAddress
GetLongPathNameA
VirtualAlloc
HeapUnlock
GetAtomNameA
DnsHostnameToComputerNameA
OpenJobObjectW
GetModuleFileNameA
GetModuleHandleA
GetConsoleTitleW
EnumCalendarInfoExA
CreateThread
SwitchToThread
TerminateProcess
DosDateTimeToFileTime
HeapAlloc
GetStartupInfoW
RaiseException
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CloseHandle
CreateFileA
HeapSize
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeW
FlushFileBuffers
SetEndOfFile
GetProcessHeap
ReadFile

user32

ShowCaret

advapi32

AdjustTokenGroups

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 275KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c1060cdad929497670e465299b2bd1a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 71KB - Virtual size: 71KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 275KB - Virtual size: 299KB

.rsrc Size: 68KB - Virtual size: 68KB

.text
Size: 71KB - Virtual size: 71KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 275KB - Virtual size: 299KB

.rsrc
Size: 68KB - Virtual size: 68KB