375cc112d9052de805951af453e483b0372f2797a09108d3c9feab4015b45e4c

General

Target

375cc112d9052de805951af453e483b0372f2797a09108d3c9feab4015b45e4c
Size

388KB
MD5

8ba64166174589397392dfb389a6471a
SHA1

d3f2fffc6c9bb244bc6de6748103ec09f9645759
SHA256

375cc112d9052de805951af453e483b0372f2797a09108d3c9feab4015b45e4c
SHA512

f3d2044c55ec41dd771c3b032734855f3a8c82f70e6ceb651e85a1e0544fd298dae025305ffbae604129d23049c480e83dad5212b7ccbd933758a38f6cc555c2
SSDEEP

6144:XjiJi6LQKqQ0O1K9QxeSSAN8BVHV2CIe997bOj3b:XX64QrK9QxeSSAN6VHYCOrb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
375cc112d9052de805951af453e483b0372f2797a09108d3c9feab4015b45e4c

Files

375cc112d9052de805951af453e483b0372f2797a09108d3c9feab4015b45e4c
.exe windows:5 windows x86 arch:x86

3cbe4c4a93fbba3e7ce46fffe9a2f60c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

wcstoul

user32

VkKeyScanExA
CreateIconFromResource

advapi32

CloseServiceHandle

ntdsapi

DsBindWithCredW

kernel32

GetTickCount
VirtualQuery
GetModuleHandleW
GetModuleHandleA
GetCommandLineA
GetVersionExA
GetStartupInfoA
SetUnhandledExceptionFilter
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
LoadLibraryExA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
UnhandledExceptionFilter
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
VirtualProtect
GetSystemInfo

Sections

.text
Size: 276KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3cbe4c4a93fbba3e7ce46fffe9a2f60c

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

user32

advapi32

ntdsapi

kernel32

Sections

.text Size: 276KB - Virtual size: 272KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 84KB - Virtual size: 82KB

.text
Size: 276KB - Virtual size: 272KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 84KB - Virtual size: 82KB