db663022646cf9c9892733d3f6ee8e565ed5d5825621d1eb1c38a99b70e1c876

Sharing

Copy URL

Twitter E-mail

General

Target

db663022646cf9c9892733d3f6ee8e565ed5d5825621d1eb1c38a99b70e1c876
Size

274KB
MD5

937ee6174125651024f986da38f2f5a5
SHA1

ce394c936275e5c66fe035f31a4dd012806c7a8c
SHA256

db663022646cf9c9892733d3f6ee8e565ed5d5825621d1eb1c38a99b70e1c876
SHA512

7df67204c288d056573b4747ef7cb79f05e49afedef2a0fbe55271b1b25426493956ebfd2c6aab2e41d4ced0e2a4f3a0d39e7369ed448f2d4d9fa717789cde9b
SSDEEP

6144:3OzLoJazKULP9wHZZNQHnjSGWLSioSEIYR/mJekTfj4B:ezUJa3p0NQHGSwNYR+BTc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db663022646cf9c9892733d3f6ee8e565ed5d5825621d1eb1c38a99b70e1c876

Files

db663022646cf9c9892733d3f6ee8e565ed5d5825621d1eb1c38a99b70e1c876
.exe windows:5 windows x86 arch:x86

a0b1048f3a07759681a1521f3786b4a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\yavojovoxulu_84-yudezana56\gazawilitavaxa26\pe.pdb

Imports

kernel32

SetDefaultCommConfigA
HeapCompact
WriteConsoleInputW
GetLocaleInfoA
GetStringTypeA
FindResourceExW
WaitForSingleObject
SetVolumeMountPointW
GetConsoleAliasesA
GlobalAlloc
SwitchToFiber
GetProcessHandleCount
GetConsoleAliasW
TerminateProcess
FileTimeToSystemTime
ReplaceFileA
DeactivateActCtx
GetLastError
GetProcAddress
VirtualAlloc
GetComputerNameExW
WriteConsoleA
GetModuleHandleA
GetConsoleTitleW
GetVersionExA
ResetWriteWatch
EnumCalendarInfoExA
HeapAlloc
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeW
RaiseException
HeapSize

winhttp

WinHttpQueryOption

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jikayu
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0b1048f3a07759681a1521f3786b4a1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

winhttp

Sections

.text Size: 215KB - Virtual size: 214KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 5KB - Virtual size: 3.9MB

.jikayu Size: 1024B - Virtual size: 626B

.rsrc Size: 40KB - Virtual size: 40KB

.text
Size: 215KB - Virtual size: 214KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 5KB - Virtual size: 3.9MB

.jikayu
Size: 1024B - Virtual size: 626B

.rsrc
Size: 40KB - Virtual size: 40KB