MDE_File_Sample_e8717ff0d40e01fd3b06de2aa5a401bed1c907cc[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

MDE_File_Sample_e8717ff0d40e01fd3b06de2aa5a401bed1c907cc.zip
Size

151KB
MD5

1415545328f90836e47c8c8b37653d2a
SHA1

d358fae549ec613a134fb1ec29a325df4bf90ab5
SHA256

a0ea8e499326d708aa4effe761da4b0f48a60c0c02e8bfbc31627cb6df9e48bd
SHA512

83d255870bae84dd30172906f37477aeed8b52f7566864af53882129ceabbd47881371c56836a6b828426a0859106ef38ee3ced8bb4cd749cbdd5ba4a0e686a8
SSDEEP

3072:R9vFj+OLX5AyQPdiQGC2IJA/FsHCPdmjaTdBu35BaKhJf1:HvkhNQmesjaTPu3Vt

Score

1^/10

Malware Config

Signatures

Files

MDE_File_Sample_e8717ff0d40e01fd3b06de2aa5a401bed1c907cc.zip
.zip

Password: sh4sh454d
utilman.exe
.exe windows x64

Password: sh4sh454d

d60b77062898dc6bfae7fe11a0f8806c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

??_V@YAXPEAX@Z
??3@YAXPEAX@Z
_purecall
memmove_s
__C_specific_handler
longjmp
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
_local_unwind
_setjmp
memcmp
memset
?terminate@@YAXXZ
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
calloc
free
_wcslwr
qsort
_dup2
_dup
_close
_open_osfhandle
_ultoa
swscanf
_ultoa_s
_pipe
wcsncmp
_setmode
exit
iswxdigit
time
srand
_wtol
fflush
wcsstr
iswalpha
wcstoul
_errno
printf
rand
fprintf
wcsrchr
memcpy_s
realloc
towlower
setlocale
_wcsupr
iswdigit
_wcsicmp
iswspace
wcschr
fgets
_pclose
ferror
feof
_wpopen
_wcsnicmp
wcstol
_get_osfhandle
_getch
towupper
wcsspn
_vsnwprintf
_tell
__iob_func
malloc
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcscmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
NtOpenProcessToken
NtQueryInformationToken
NtClose
NtOpenThreadToken
RtlFreeHeap
NtFsControlFile
RtlDosPathNameToNtPathName_U
RtlVirtualUnwind
RtlFreeUnicodeString
RtlReleaseRelativeName
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
NtQueryVolumeInformationFile
NtSetInformationProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtCancelSynchronousIoFile
RtlCreateUnicodeStringFromAsciiz
RtlFindLeastSignificantBit

api-ms-win-core-kernel32-legacy-l1-1-0

CopyFileW
GetConsoleWindow

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
TryAcquireSRWLockExclusive
InitializeCriticalSection
WaitForSingleObject
ReleaseMutex
InitializeCriticalSectionEx
AcquireSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
DeleteCriticalSection
CreateMutexExW
LeaveCriticalSection
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapAlloc
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
SetErrorMode
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

UpdateProcThreadAttribute
GetCurrentProcessId
DeleteProcThreadAttributeList
TerminateProcess
GetStartupInfoW
ResumeThread
CreateProcessAsUserW
CreateProcessW
GetExitCodeProcess
OpenThread
InitializeProcThreadAttributeList
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetACP
SetThreadLocale
GetUserDefaultLCID
GetCPInfo
GetLocaleInfoW
GetThreadLocale

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
ReadProcessMemory
VirtualQuery

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
GetConsoleMode
WriteConsoleW
ReadConsoleW
SetConsoleMode
GetConsoleOutputCP

api-ms-win-core-file-l1-1-0

FindFirstFileW
FindNextFileW
GetFileType
GetVolumeInformationW
GetDriveTypeW
GetFileAttributesExW
GetFileAttributesW
GetFullPathNameW
SetFilePointer
SetFilePointerEx
FlushFileBuffers
GetFileSize
ReadFile
WriteFile
GetVolumePathNameW
CreateDirectoryW
SetFileAttributesW
SetEndOfFile
DeleteFileW
SetFileTime
RemoveDirectoryW
FindFirstFileExW
GetDiskFreeSpaceExW
CompareFileTime
FindClose
FileTimeToLocalFileTime
CreateFileW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentStringsW
GetCurrentDirectoryW
SearchPathW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
SetCurrentDirectoryW
GetCommandLineW
GetEnvironmentStringsW

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute
FillConsoleOutputAttribute
ScrollConsoleScreenBufferW
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
SetConsoleCursorPosition
FlushConsoleInputBuffer

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorOwner
RevertToSelf
GetFileSecurityW

api-ms-win-core-sysinfo-l1-1-0

GetVersion
GetWindowsDirectoryW
SetLocalTime
GetSystemTime
GetLocalTime
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-systemtopology-l1-1-0

GetNumaNodeProcessorMaskEx
GetNumaHighestNodeNumber

api-ms-win-core-console-l2-2-0

SetConsoleTitleW
GetConsoleTitleW

api-ms-win-core-processenvironment-l1-2-0

NeedCurrentDirectoryForExePathW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
MoveFileWithProgressW
MoveFileExW
CreateHardLinkW
CreateSymbolicLinkW

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
GlobalFree

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize

api-ms-win-core-processtopology-l1-1-0

GetThreadGroupAffinity

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-processtopology-obsolete-l1-1-0

SetProcessAffinityMask

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 216KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: sh4sh454d

Password: sh4sh454d

d60b77062898dc6bfae7fe11a0f8806c

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processtopology-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 216KB - Virtual size: 212KB

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 4KB - Virtual size: 111KB

.pdata Size: 12KB - Virtual size: 9KB

.didat Size: 4KB - Virtual size: 144B

.rsrc Size: 36KB - Virtual size: 33KB

.reloc Size: 4KB - Virtual size: 816B

.text
Size: 216KB - Virtual size: 212KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 4KB - Virtual size: 111KB

.pdata
Size: 12KB - Virtual size: 9KB

.didat
Size: 4KB - Virtual size: 144B

.rsrc
Size: 36KB - Virtual size: 33KB

.reloc
Size: 4KB - Virtual size: 816B