1[.]scr | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

1.scr
Size

360KB
MD5

6bfdcc4ccf6fcecfaaa93d739a96fca4
SHA1

522d5acd2038c3d041c81da3c7700f669266d0e6
SHA256

63ac601ff1e5f4b6d85af85dda5948c2bbe54ace28efd3dae5deb7d7acf51b79
SHA512

818cb68309c5d019e7d57850fbbddf45fcf09e63e5c30ed7979b96fa4766abf315595793839cfbfe8a3e91ad7ada1c52f0279ccf24617b81461a8692796f0f9d
SSDEEP

1536:aok5ZSeS94jylSmuZxk2dlP43LTft9WP+by:aFmMfJZxk2dlTP+

Score

N/A

Malware Config

Signatures

Files

1.scr
.exe windows x64

708ec1927e48bfe2596efe1e5a977ac5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mfc140

ord5211
ord7890
ord7881
ord3710
ord13284
ord5704
ord3804
ord4648
ord2264
ord2207
ord316
ord1032
ord8128
ord266
ord7206
ord8888
ord450
ord6266
ord3723
ord5687
ord11869
ord7888
ord11881
ord11849
ord8131
ord7363
ord8050
ord11877
ord10079
ord12552
ord12490
ord7989
ord5167
ord9795
ord9792
ord2437
ord12170
ord12171
ord14135
ord7619
ord14133
ord9049
ord4002
ord3941
ord12571
ord7637
ord7420
ord11614
ord11615
ord14007
ord12160
ord7688
ord14207
ord6100
ord14209
ord6102
ord14208
ord6101
ord12869
ord7430
ord11754
ord11761
ord5980
ord13327
ord2695
ord8863
ord1087
ord8693
ord10657
ord11037
ord10117
ord3943
ord3300
ord3299
ord3066
ord12212
ord13857
ord8140
ord8861
ord8627
ord13766
ord11532
ord12631
ord2723
ord8122
ord5086
ord4437
ord1447
ord982
ord6591
ord1089
ord6229
ord1887
ord5539
ord9898
ord8862
ord3748
ord6299
ord265
ord11798
ord3165
ord3270
ord3271
ord2627
ord11357
ord6607
ord14134
ord7620
ord14136
ord2962
ord4343
ord9343
ord5566
ord4351
ord4817
ord4756
ord4741
ord4803
ord4848
ord4771
ord4826
ord4842
ord4783
ord4789
ord4795
ord4777
ord4832
ord4765
ord1750
ord1729
ord1743
ord1717
ord1695
ord11888
ord11892
ord13438
ord3166
ord10644
ord6703
ord8618
ord14128
ord11575
ord8792
ord11366
ord11365
ord5435
ord9936
ord9932
ord9934
ord9935
ord9933
ord14279
ord9903
ord3202
ord3205
ord2004
ord7431
ord1485
ord5049
ord5213
ord5067
ord5323
ord9001
ord5536
ord5347
ord5064
ord11719
ord11803
ord2368
ord1487

kernel32

OutputDebugStringW
InitializeCriticalSectionEx
GetLastError
VirtualProtect
VirtualAlloc
EnumUILanguagesW
lstrlenA
lstrcatA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentProcess
GetModuleHandleA
GetProcAddress
IsDebuggerPresent
IsProcessorFeaturePresent
CheckRemoteDebuggerPresent
CloseHandle
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW

user32

wsprintfA
EnableWindow

wininet

InternetConnectA
InternetReadFile
FtpOpenFileA
InternetCrackUrlA
FtpGetFileSize
InternetCloseHandle
InternetOpenA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
__std_exception_destroy
__std_exception_copy
memset
__C_specific_handler
__current_exception
__current_exception_context
memmove
memcpy
_CxxThrowException

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
terminate
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
exit
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
_setmbcp

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 329KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

708ec1927e48bfe2596efe1e5a977ac5

Headers

DLL Characteristics

File Characteristics

Imports

mfc140

kernel32

user32

wininet

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 888B

.rsrc Size: 329KB - Virtual size: 329KB

.reloc Size: 1024B - Virtual size: 552B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 888B

.rsrc
Size: 329KB - Virtual size: 329KB

.reloc
Size: 1024B - Virtual size: 552B