589c8ee4e37d371ac8179b5eaddf45faa5a6bd0583363f52f07f355e207093bb

Sharing

Copy URL

Twitter E-mail

General

Target

589c8ee4e37d371ac8179b5eaddf45faa5a6bd0583363f52f07f355e207093bb
Size

240KB
MD5

e9df12f34bd86d595e897ea763e50bf5
SHA1

02d9f0c4e9712d40efcb4c7424892ad7545a2271
SHA256

589c8ee4e37d371ac8179b5eaddf45faa5a6bd0583363f52f07f355e207093bb
SHA512

5e2687aaa99e35f7c88081e5182458b81a8e4848e0bfa3948076449b1014eef0eeaef6b5bd0d777b7535b4ee76c3e2ad7553b907ca45b126b4cc2f2d30f7075f
SSDEEP

6144:eO3rIFEVIomVcSt9Nzw+dGaWKtgwkutXl+K1De9zZBX:VlSbdG0tquJ5DM3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
589c8ee4e37d371ac8179b5eaddf45faa5a6bd0583363f52f07f355e207093bb

Files

589c8ee4e37d371ac8179b5eaddf45faa5a6bd0583363f52f07f355e207093bb
.exe windows:4 windows x86 arch:x86

3eb9ffc35334c4146a9daab9c10cbe05

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
GetProcAddress
GetModuleHandleA
GetVersionExA
SetLastError
CreateDirectoryA
SetFileAttributesA
GetFileAttributesA
CopyFileA
RemoveDirectoryA
FindNextFileA
GetSystemDirectoryA
GetUserDefaultLangID
WinExec
Sleep
SetCurrentDirectoryA
GetCurrentProcess
GetCurrentThread
FormatMessageA
HeapFree
GetProcessHeap
HeapAlloc
OpenProcess
GetTickCount
CreateProcessA
FlushFileBuffers
HeapSize
SetStdHandle
lstrcmpA
InterlockedExchange
InitializeCriticalSection
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapReAlloc
VirtualAlloc
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FreeLibrary
LoadLibraryA
GetModuleFileNameA
SetFilePointer
GetLastError
GetPrivateProfileStringA
CreateMutexA
WaitForSingleObject
WriteFile
GetTempPathA
GetTempFileNameA
CreateFileA
GetFileSize
ReadFile
FindFirstFileA
FindClose
DeleteFileA
CloseHandle
LocalFree
lstrlenW
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
TlsAlloc
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
ExitProcess
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
DeleteCriticalSection
LeaveCriticalSection

user32

LoadStringA
DefWindowProcA
PostQuitMessage
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
LoadIconA
DispatchMessageA
FindWindowA
KillTimer
PostMessageA
SendMessageA
SetTimer
GetMessageA
TranslateMessage

winspool.drv

EnumPrintersA
ClosePrinter
GetPrinterDriverA
OpenPrinterA
EnumPrinterDriversA
GetPrinterDriverDirectoryA
GetPrinterA
SetPrinterA
AddMonitorA
DeleteMonitorA
AddPrinterDriverA

advapi32

AllocateAndInitializeSid
LookupAccountSidA
CreateProcessAsUserA
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetLengthSid
CopySid
RegGetKeySecurity
GetSecurityDescriptorDacl
GetAclInformation
GetSidSubAuthorityCount
GetAce
GetSidSubAuthority
RegSetKeySecurity
RegDeleteKeyA
RegSetValueExA
RegDeleteValueA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
FreeSid
EqualSid
RegOpenKeyA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3eb9ffc35334c4146a9daab9c10cbe05

Headers

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

shell32

ole32

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 72KB - Virtual size: 72KB

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 72KB - Virtual size: 72KB