ff4967aa2cefcb0628fdc68040621351b14ea20b28a339b42e57cd3c4f35e7ff

Sharing

Copy URL

Twitter E-mail

General

Target

ff4967aa2cefcb0628fdc68040621351b14ea20b28a339b42e57cd3c4f35e7ff
Size

1.3MB
MD5

55645546b1914c2701df42bc676bd482
SHA1

9e53f78f1b7eb9e5fd47114e5e77738a58e5abdb
SHA256

ff4967aa2cefcb0628fdc68040621351b14ea20b28a339b42e57cd3c4f35e7ff
SHA512

d643f34610417a95a9bebe0b95ee1efcc408c4974b7ddb3a3e864c6e5f39744f79b316cd5b187425b13e6d08eefa7d1900d4bf2037507652c00bee599444adb4
SSDEEP

24576:Uh4cQjmoXnx/Oz+lOTKOHsQlr7K6WVZ6GwuwTbhEkA7u9:UqEqlZlOe/1bwvTbhE5y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff4967aa2cefcb0628fdc68040621351b14ea20b28a339b42e57cd3c4f35e7ff

Files

ff4967aa2cefcb0628fdc68040621351b14ea20b28a339b42e57cd3c4f35e7ff
.exe windows:4 windows x86 arch:x86

452a49833d1f88fa7b771bd8d0a91a5d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
FreeLibrary
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
WriteFile
IsBadWritePtr
IsBadReadPtr
HeapValidate
HeapAlloc
HeapReAlloc
DebugBreak
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

user32

GetWindow

advapi32

RegDeleteKeyA

shell32

SHGetFolderPathW

Sections

.text
Size: 412KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 856KB - Virtual size: 856KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

452a49833d1f88fa7b771bd8d0a91a5d

Headers

File Characteristics

Imports

kernel32

msvcrt

iphlpapi

psapi

user32

advapi32

shell32

Sections

.text Size: 412KB - Virtual size: 412KB

.sedata Size: 856KB - Virtual size: 856KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 32KB - Virtual size: 32KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 412KB - Virtual size: 412KB

.sedata
Size: 856KB - Virtual size: 856KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 32KB - Virtual size: 32KB

.sedata
Size: 4KB - Virtual size: 4KB