829cb13654c9fd806cc709a93e8a4de447caa14c8b7590285ca2855c63be05a9

Sharing

Copy URL

Twitter E-mail

General

Target

829cb13654c9fd806cc709a93e8a4de447caa14c8b7590285ca2855c63be05a9
Size

358KB
MD5

68ef1e9ad038923934928b4f97b9ca59
SHA1

8e0070c8f230cf9d812f08b632556dfbec33dbb2
SHA256

829cb13654c9fd806cc709a93e8a4de447caa14c8b7590285ca2855c63be05a9
SHA512

5a34bf61f8927bedeaf3c1e35c4b55f4172d0fd306731fd0cb60f3d3ba41a5c5cdd440abfdcc47b8b27a4c72f356c960b63669a209fbc5a92f45e933fdaab201
SSDEEP

6144:4KDAAcQEbU3G7O/hCT2/NzJbSMdeq+0TVr+:4KDAAcQEb77OphJJbjMjmr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
829cb13654c9fd806cc709a93e8a4de447caa14c8b7590285ca2855c63be05a9

Files

829cb13654c9fd806cc709a93e8a4de447caa14c8b7590285ca2855c63be05a9
.exe windows:5 windows x86 arch:x86

c240386fd77e6beba15b6f939f6cee41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\hodukofojit.pdb

Imports

kernel32

SetThreadContext
FindFirstChangeNotificationW
GetConsoleAliasExesLengthA
CallNamedPipeA
InterlockedIncrement
GetQueuedCompletionStatus
CancelWaitableTimer
UnlockFile
SetEvent
FreeEnvironmentStringsA
GetModuleHandleW
CreateNamedPipeW
SetCommState
GetPrivateProfileIntA
GetSystemDirectoryW
HeapCreate
TerminateProcess
FileTimeToSystemTime
GetModuleFileNameW
lstrlenW
GetPrivateProfileIntW
InterlockedExchange
GetStartupInfoA
FreeLibraryAndExitThread
OpenMutexW
GetLastError
GetFileSize
GetThreadLocale
GetProcAddress
SetStdHandle
EnterCriticalSection
LoadLibraryA
CreateSemaphoreW
LocalAlloc
WritePrivateProfileStringA
GetNumberFormatW
GetProfileStringA
SetThreadIdealProcessor
HeapWalk
FindAtomA
GlobalWire
FreeEnvironmentStringsW
FindNextFileW
WriteProfileStringW
GetCPInfoExA
SetFileShortNameA
TlsAlloc
EnumResourceLanguagesW
GetSystemTime
LCMapStringW
CopyFileExA
DeleteFileA
GetVolumeInformationW
GetCurrentDirectoryW
GetCommandLineW
MoveFileA
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
HeapValidate
IsBadReadPtr
InterlockedDecrement
ExitProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsSetValue
TlsFree
SetLastError
WriteFile
LeaveCriticalSection
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
LoadLibraryW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
IsProcessorFeaturePresent
GetStringTypeW
CreateFileW
CloseHandle
FlushFileBuffers
RaiseException

advapi32

InitiateSystemShutdownA

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 142KB - Virtual size: 39.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c240386fd77e6beba15b6f939f6cee41

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 142KB - Virtual size: 39.4MB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 66KB - Virtual size: 65KB

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 142KB - Virtual size: 39.4MB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 66KB - Virtual size: 65KB