0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25[.]exe

General

Target

0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25.exe
Size

4.5MB
MD5

f8500ef014255ed6e41d00ea463fbd99
SHA1

b796cbcaea95c0d0ca2b0810662296a847422837
SHA256

0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25
SHA512

0bea2f08c71446210e6028c38e42acf1a80e500089e2579ac0d7e7a24a5a98b0304d2528617bc7633290ede1a441f7460c6468f4aaa8820fd371bab54739e041
SSDEEP

98304:0LGndMtSs1diDUEABksWQRChubqsLP+zhdBH8XMlMa+XMW4nC2:b8szfsoV32MoXMLC2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25.exe

Files

0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25.exe
.exe windows:6 windows x86 arch:x86

908bea7ee71339f1c35ba419da3ba679

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSSendMessageW

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bykejxq
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.IQ812jn
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.IQ812jn
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

908bea7ee71339f1c35ba419da3ba679

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

wtsapi32

Sections

.text Size: 136KB - Virtual size: 135KB

.bykejxq Size: 3KB - Virtual size: 3KB

.rdata Size: 59KB - Virtual size: 59KB

.data Size: 4KB - Virtual size: 7KB

.IQ812jn Size: 2.5MB - Virtual size: 2.5MB

.IQ812jn Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 16KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 136KB - Virtual size: 135KB

.bykejxq
Size: 3KB - Virtual size: 3KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 4KB - Virtual size: 7KB

.IQ812jn
Size: 2.5MB - Virtual size: 2.5MB

.IQ812jn
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB