8b33cefab03bdabb7b5e65cfad6e210d021cba11e4f47b69f1730341767ac99f

Sharing

Copy URL

Twitter E-mail

General

Target

8b33cefab03bdabb7b5e65cfad6e210d021cba11e4f47b69f1730341767ac99f
Size

289KB
MD5

0aaf0b08bf147f91ed04557b8e867e22
SHA1

0163ebbbc2a28a50c1b8c4bbd449a1030d56f402
SHA256

8b33cefab03bdabb7b5e65cfad6e210d021cba11e4f47b69f1730341767ac99f
SHA512

36f1879a332572ad5fb1ef61e59a77530c927e8977d79f5e3e7302dfa02363b0361ded96ed82401bace28d477a2d106fe321744c9dbe483d5df7aea24d83ce9c
SSDEEP

3072:vOG+vRWopwSVz+VhsU8RIvrUoByWm0KIVggjcGkNIVqICBJ71D60qo5E:vOoopwSVz861Ovr1yl0p7ITsqdL0ZX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b33cefab03bdabb7b5e65cfad6e210d021cba11e4f47b69f1730341767ac99f

Files

8b33cefab03bdabb7b5e65cfad6e210d021cba11e4f47b69f1730341767ac99f
.exe windows:5 windows x86 arch:x86

8b318cf55c5e05444f521cf810458a29

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vofuhuta.pdb

Imports

kernel32

GetConsoleAliasesLengthW
CommConfigDialogA
FindResourceW
FreeLibrary
InterlockedIncrement
GetCurrentProcess
GetEnvironmentStringsW
GetModuleHandleW
EnumCalendarInfoExW
GetSystemDirectoryW
LoadLibraryW
GetConsoleMode
CreateEventA
GetModuleFileNameW
GetBinaryTypeW
lstrcmpA
GetLastError
SetLastError
GetProcAddress
GetDiskFreeSpaceW
LoadLibraryA
GetProcessWorkingSetSize
LocalAlloc
MoveFileA
TransmitCommChar
OpenJobObjectW
SetFileAttributesW
SetDefaultCommConfigA
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
ExitProcess
DecodePointer
WriteFile
GetStdHandle
EncodePointer
WideCharToMultiByte
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
SetFilePointer
GetModuleFileNameA
FreeEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteConsoleW
MultiByteToWideChar
SetStdHandle
FlushFileBuffers
Sleep
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RaiseException
HeapSize
CreateFileW
CloseHandle
GetStringTypeW
HeapReAlloc
LCMapStringW

advapi32

CreateRestrictedToken

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wayud
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mus
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b318cf55c5e05444f521cf810458a29

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 138KB - Virtual size: 138KB

.data Size: 66KB - Virtual size: 646KB

.wayud Size: 3KB - Virtual size: 2KB

.mus Size: 1024B - Virtual size: 624B

.rsrc Size: 73KB - Virtual size: 72KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 138KB - Virtual size: 138KB

.data
Size: 66KB - Virtual size: 646KB

.wayud
Size: 3KB - Virtual size: 2KB

.mus
Size: 1024B - Virtual size: 624B

.rsrc
Size: 73KB - Virtual size: 72KB

.reloc
Size: 6KB - Virtual size: 5KB