542e34a195575ac5cba588ab99ee6890b252a0f983840465d1e55d568db84891

Sharing

Copy URL

Twitter E-mail

General

Target

542e34a195575ac5cba588ab99ee6890b252a0f983840465d1e55d568db84891
Size

352KB
MD5

8adb248c62e9a8d4ac93a2001b92df1c
SHA1

90d6c4f918841cc5d880fedc3f35c30e91292130
SHA256

542e34a195575ac5cba588ab99ee6890b252a0f983840465d1e55d568db84891
SHA512

d87e90a87e584a1b20bb71adde22f46eb073f7a95dd54adf68bd6285712dd491b8a051209712836204ea0d9e8117a39f6ab7baea8b030fce6ace770da9c6c1e8
SSDEEP

3072:LTL3Afq8nkgV0AEaGdD0ASqf71YqA7E698YkpgzxOlDD5JEH68aKeeH4yB3bB:/L3AfdbV/UdD0ARTHE0YuG8ZkHgBIB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
542e34a195575ac5cba588ab99ee6890b252a0f983840465d1e55d568db84891

Files

542e34a195575ac5cba588ab99ee6890b252a0f983840465d1e55d568db84891
.exe windows:5 windows x86 arch:x86

04075921d57c946566528251a2d0ba17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\pisibiri68\facagiyacuku kurajisen\56\lew.pdb

Imports

kernel32

HeapCompact
WriteConsoleInputW
GetLocaleInfoA
GetStringTypeA
CompareFileTime
SetVolumeMountPointW
GetConsoleAliasesA
FindResourceExA
SwitchToFiber
ReadFileScatter
GetConsoleAliasW
TerminateProcess
ReplaceFileA
DeactivateActCtx
GetLastError
GetProcAddress
VirtualAlloc
GetComputerNameExW
WriteConsoleA
LocalAlloc
GetModuleHandleA
GetConsoleTitleW
ReleaseMutex
GetVersionExA
TerminateJobObject
ResetWriteWatch
EnumCalendarInfoExA
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
WideCharToMultiByte
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeW

winhttp

WinHttpQueryOption

Sections

.text
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.puw
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04075921d57c946566528251a2d0ba17

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

winhttp

Sections

.text Size: 297KB - Virtual size: 296KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 3.9MB

.puw Size: 1024B - Virtual size: 626B

.rsrc Size: 40KB - Virtual size: 40KB

.text
Size: 297KB - Virtual size: 296KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 3.9MB

.puw
Size: 1024B - Virtual size: 626B

.rsrc
Size: 40KB - Virtual size: 40KB