imagem[.]jpg | Triage

Sharing

Copy URL Twitter E-mail

General

Target

imagem.jpg
Size

6.0MB
MD5

03e3758f3e8f9b41c4482418dfc7f949
SHA1

a9567f232d2a7511015af599b9703d34afcb5c8a
SHA256

9c2cb8a7798c29f281cd0e03488aec0387bbceceff300f6ca8366612405d55e4
SHA512

31e4a96689cf1e910df06f54cc676ab02600f61c30c4ce46c94d722646bf672c62fa4d41e39602ede25e74aaf73a148e66f9a42b90d60f06ba6ce2439f4d7eae
SSDEEP

49152:jqfYTf0QLzmqZUOhpPf9gjAy0m7IIMomhwq7228cu0M7DdYkV6leDlS0Cc155Kkj:2ATf0g1QIk8y2EG9DcFk4GX6jnX+I

Score

N/A

Malware Config

Signatures

Files

imagem.jpg
.exe windows x64

bfd001fef2f11a556fba430bf72d2a3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

ApplyControlToken
DecryptMessage
QueryContextAttributesW
LsaGetLogonSessionData
AcquireCredentialsHandleA
AcceptSecurityContext
EncryptMessage
FreeCredentialsHandle
DeleteSecurityContext
InitializeSecurityContextW
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
FreeContextBuffer

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentThreadId
TryEnterCriticalSection
InitializeCriticalSection
AreFileApisANSI
HeapCreate
WriteFile
GetDiskFreeSpaceW
IsDebuggerPresent
HeapFree
AcquireSRWLockExclusive
CloseHandle
FindClose
ReleaseSRWLockExclusive
GetLastError
GetSystemInfo
HeapReAlloc
RemoveDirectoryW
GetModuleFileNameW
SetFileInformationByHandle
GetUserPreferredUILanguages
GetComputerNameExW
LoadLibraryExW
GetProcAddress
FreeLibrary
Sleep
GlobalLock
GlobalSize
WideCharToMultiByte
GlobalUnlock
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GlobalAlloc
GlobalFree
SleepConditionVariableSRW
WakeAllConditionVariable
GetModuleHandleW
CreateFileW
SwitchToThread
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
WakeConditionVariable
AcquireSRWLockShared
ReleaseSRWLockShared
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
SetFilePointerEx
GetFileInformationByHandleEx
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
CopyFileExW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
GetProcessTimes
OpenProcess
ReadProcessMemory
VirtualQueryEx
GetSystemTimes
GetProcessIoCounters
LocalFree
GlobalMemoryStatusEx
GetTickCount64
GetLogicalDrives
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA

ntdll

NtCreateFile
NtQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
NtCancelIoFileEx
RtlGetVersion
NtDeviceIoControlFile

oleaut32

SafeArrayAccessData
SafeArrayGetLBound
VariantClear
SysAllocStringLen
SafeArrayGetUBound
SafeArrayDestroy
SysAllocString
SysFreeString
SafeArrayUnaccessData

pdh

PdhAddEnglishCounterW
PdhRemoveCounter
PdhOpenQueryA
PdhCollectQueryData
PdhCloseQuery
PdhGetFormattedCounterValue

crypt32

CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateChain
CertFindCertificateInStore
CertDuplicateStore
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CryptUnprotectData
CryptDecodeObjectEx
CertGetCertificateChain

user32

GetClipboardData
CloseClipboard
EnumDisplaySettingsExW
SetClipboardData
GetMonitorInfoW
EnumDisplayMonitors
EmptyClipboard
OpenClipboard

gdi32

CreateCompatibleBitmap
DeleteDC
DeleteObject
GetObjectW
GetDIBits
StretchBlt
SetStretchBltMode
GetDeviceCaps
SelectObject
CreateCompatibleDC
CreateDCW

advapi32

CryptDestroyHash
AllocateAndInitializeSid
GetUserNameW
FreeSid
RegCreateKeyExA
RegSetValueExA
CheckTokenMembership
SystemFunction036
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider

ws2_32

shutdown
__WSAFDIsSet
accept
htonl
listen
select
WSACloseEvent
WSACreateEvent
recv
send
getsockname
WSASend
WSAEnumNetworkEvents
getpeername
getsockopt
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
setsockopt
WSASocketW
bind
WSAEventSelect
connect
WSAIoctl
closesocket
WSAGetLastError
recvfrom
WSAResetEvent
WSAWaitForMultipleEvents
htons
ntohs
socket
WSARecv
WSASetLastError
ioctlsocket

shell32

CommandLineToArgvW

ole32

CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

iphlpapi

GetIfTable2
GetIfEntry2
FreeMibTable

powrprof

CallNtPowerInformation

netapi32

NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

psapi

GetModuleFileNameExW
GetPerformanceInfo

vcruntime140

strchr
strstr
memchr
__C_specific_handler
memmove
__CxxFrameHandler3
__current_exception
memset
__current_exception_context
memcpy
memcmp
strrchr

api-ms-win-crt-string-l1-1-0

strcmp
strcpy
strpbrk
strncmp
_strdup
strspn
wcslen
strncpy
strlen
strcspn

api-ms-win-crt-heap-l1-1-0

_msize
_set_new_mode
malloc
free
realloc
calloc

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
terminate
abort
_endthreadex
__sys_nerr
_wassert
_crt_atexit
_seh_filter_exe
_set_app_type
__sys_errlist
_errno
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_c_exit
_cexit
_exit
_beginthreadex
__p___argc
__p___argv

api-ms-win-crt-convert-l1-1-0

strtoll
atoi
wcstombs
strtol
strtoul

api-ms-win-crt-stdio-l1-1-0

fread
fgets
_lseeki64
_open
fopen
fflush
__stdio_common_vsprintf
_set_fmode
fputc
fwrite
ftell
feof
_close
fclose
__acrt_iob_func
__stdio_common_vsscanf
fputs
__p__commode
fseek
_write
_read

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_gmtime64
_localtime64_s
_time64
strftime

api-ms-win-crt-filesystem-l1-1-0

_stat64
_unlink
_access
_fstat64

api-ms-win-crt-math-l1-1-0

_dclass
__setusermatherr
log
_fdopen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfd001fef2f11a556fba430bf72d2a3d

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

ntdll

oleaut32

pdh

crypt32

user32

gdi32

advapi32

bcrypt

ws2_32

shell32

ole32

iphlpapi

powrprof

netapi32

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 29KB - Virtual size: 32KB

.pdata Size: 101KB - Virtual size: 100KB

.reloc Size: 44KB - Virtual size: 43KB

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 29KB - Virtual size: 32KB

.pdata
Size: 101KB - Virtual size: 100KB

.reloc
Size: 44KB - Virtual size: 43KB