fbf61f8e9c8b94648780e6007e237083

Sharing

Copy URL

Twitter E-mail

General

Target

fbf61f8e9c8b94648780e6007e237083
Size

379KB
MD5

fbf61f8e9c8b94648780e6007e237083
SHA1

a7fd8f0c0cbe9838b76027b2a8e5b5330c08e7ca
SHA256

9ce20d854270fcbffb9ddc11be1bae575e4db4ef7a6786f4d299f93fc60905dc
SHA512

930a8e82dce117d0173d27ed52156c7bf8af6501e4c61dbe9e00c3697a6afcec73f05f35bd5594c776cad52e493f448d9f7bfa6cae53455c3aeefb185110d945
SSDEEP

6144:jsXfc6kVbmQWW1u1jDivIU42CF+1PvniwyfoIYnxWPsK5:IXE6kKjDW1PviNbqxW0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbf61f8e9c8b94648780e6007e237083

Files

fbf61f8e9c8b94648780e6007e237083
.exe windows:5 windows x86 arch:x86

6f7f7795d0111d5087004eeee90a01d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\nafuribohawome_bayelixajefun\r.pdb

Imports

kernel32

SetEnvironmentVariableW
FreeEnvironmentStringsA
GetProcessHeap
GetConsoleAliasesLengthA
ReadConsoleW
CreateRemoteThread
GlobalAlloc
GetPrivateProfileIntA
AddRefActCtx
GetLocaleInfoW
ReadConsoleInputA
SetVolumeMountPointA
GetBinaryTypeA
GetSystemDirectoryA
lstrlenW
ReplaceFileA
GetCPInfoExW
SetLastError
AllocConsole
SetStdHandle
GetAtomNameA
LoadLibraryA
WriteConsoleA
SetCalendarInfoW
SetConsoleWindowInfo
GetModuleFileNameA
GetDefaultCommConfigA
WriteProfileStringA
GetModuleHandleA
UpdateResourceW
VirtualProtect
CompareStringA
GetVersionExA
AddConsoleAliasA
CloseHandle
FindFirstChangeNotificationW
VirtualAlloc
LocalUnlock
CreateFileA
FlushFileBuffers
GetLastError
HeapFree
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapSize
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
WriteFile
InitializeCriticalSectionAndSpinCount
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

WindowFromPoint

advapi32

GetOldestEventLogRecord

winhttp

WinHttpCloseHandle

Sections

.text
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dodoxob
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f7f7795d0111d5087004eeee90a01d8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

winhttp

Sections

.text Size: 331KB - Virtual size: 331KB

.data Size: 28KB - Virtual size: 213KB

.dodoxob Size: 3KB - Virtual size: 2KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 331KB - Virtual size: 331KB

.data
Size: 28KB - Virtual size: 213KB

.dodoxob
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 16KB - Virtual size: 16KB