27454f182561706a81608812d2de2630b27fd4b8b0429132e2a99328f583410f

Sharing

Copy URL

Twitter E-mail

General

Target

27454f182561706a81608812d2de2630b27fd4b8b0429132e2a99328f583410f
Size

330KB
MD5

91d6e18510eef4b2dead93a529485f2e
SHA1

c6c6527092f66568ad1eb9961f5545ee1196837c
SHA256

27454f182561706a81608812d2de2630b27fd4b8b0429132e2a99328f583410f
SHA512

0ae0d9b86342b2e761556c3ef4b1ec520ab1827a6ddd63db32293bb06a66e5fc5602536c89563cb716a9482975df2d69dbb168e947916a493fe401180505086a
SSDEEP

3072:kXxvOHy3USPLNQ+TeY3irFs+5scEVkp6NHIFI4xbCAqnPSVoMbX0yWxK0rMVt7ST:gBOHyEwLz3sFsJSpKARn6M70ZrrMC7C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
27454f182561706a81608812d2de2630b27fd4b8b0429132e2a99328f583410f

Files

27454f182561706a81608812d2de2630b27fd4b8b0429132e2a99328f583410f
.exe windows:5 windows x86 arch:x86

82dde10599f30127ff14b7c88ea6110f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\yodoroj gozu.pdb

Imports

kernel32

GetSystemDefaultLCID
GetModuleHandleW
GetConsoleAliasesA
WaitNamedPipeW
GetVolumePathNameW
GetVolumeInformationA
LoadLibraryW
IsProcessInJob
AssignProcessToJobObject
GetCalendarInfoA
EnumSystemCodePagesA
GetFileAttributesW
WriteConsoleW
SetThreadPriority
LCMapStringA
FillConsoleOutputCharacterW
GetComputerNameW
GetProcAddress
VirtualAlloc
SetFileAttributesA
LoadLibraryA
WriteConsoleA
LocalAlloc
SetProcessWorkingSetSize
OpenJobObjectW
FoldStringW
FoldStringA
FindFirstChangeNotificationA
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
AddConsoleAliasA
GetProfileIntW
CreateJobObjectW
TlsGetValue
GetLastError
GetFullPathNameA
HeapAlloc
Sleep
ExitProcess
GetStartupInfoW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
HeapReAlloc
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
GetConsoleOutputCP
MultiByteToWideChar
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
CreateFileA
GetModuleHandleA
HeapSize
GetLocaleInfoA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
GetProcessHeap
ReadFile

gdi32

GetTextExtentExPointW

advapi32

BackupEventLogA
ReportEventW

Sections

.text
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.domey
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bacane
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82dde10599f30127ff14b7c88ea6110f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

advapi32

Sections

.text Size: 91KB - Virtual size: 91KB

.data Size: 111KB - Virtual size: 122KB

.domey Size: 3KB - Virtual size: 2KB

.bacane Size: 1024B - Virtual size: 624B

.rsrc Size: 115KB - Virtual size: 115KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 91KB - Virtual size: 91KB

.data
Size: 111KB - Virtual size: 122KB

.domey
Size: 3KB - Virtual size: 2KB

.bacane
Size: 1024B - Virtual size: 624B

.rsrc
Size: 115KB - Virtual size: 115KB

.reloc
Size: 7KB - Virtual size: 6KB