Overview
overview
10Static
static
100159c3b4fd...b5.ps1
windows7-x64
10159c3b4fd...b5.ps1
windows10-2004-x64
104d3be48fd3...50c520
windows7-x64
14d3be48fd3...50c520
windows10-2004-x64
155ba36d2ee...fd.ps1
windows7-x64
755ba36d2ee...fd.ps1
windows10-2004-x64
105722345082...f5c80a
windows7-x64
15722345082...f5c80a
windows10-2004-x64
1a12c34fef1...a7.exe
windows7-x64
1a12c34fef1...a7.exe
windows10-2004-x64
1b3ceead849...32.ps1
windows7-x64
7b3ceead849...32.ps1
windows10-2004-x64
8b62ea075cf...5d.exe
windows7-x64
1b62ea075cf...5d.exe
windows10-2004-x64
1d6150fd4d9...b8.exe
windows7-x64
3d6150fd4d9...b8.exe
windows10-2004-x64
3e6834bbc99...91.ps1
windows7-x64
7e6834bbc99...91.ps1
windows10-2004-x64
10Behavioral task
behavioral1
Sample
0159c3b4fdff4ba89ff9e56bf2cdcdc8aaaa35d1fa4661288225e3701f8569b5.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0159c3b4fdff4ba89ff9e56bf2cdcdc8aaaa35d1fa4661288225e3701f8569b5.ps1
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
4d3be48fd3dde635cccd87a9925749c5a166e9b52026b5277883c7f3ab50c520
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
4d3be48fd3dde635cccd87a9925749c5a166e9b52026b5277883c7f3ab50c520
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
55ba36d2ee2c5359dec3a425d27df9c3fb1ddede8cef74fd0bd69d38434609fd.ps1
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
55ba36d2ee2c5359dec3a425d27df9c3fb1ddede8cef74fd0bd69d38434609fd.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
57223450820cbe9cf5779083b7d85c440bb8b529505c55579bfcc5816bf5c80a
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
57223450820cbe9cf5779083b7d85c440bb8b529505c55579bfcc5816bf5c80a
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
b3ceead8490dd68c344d5b009a8bf17ed7d24499a9d66dc3493033b5696f6632.ps1
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
b3ceead8490dd68c344d5b009a8bf17ed7d24499a9d66dc3493033b5696f6632.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
b62ea075cfc99980488bc206cba24ffcd4faccd8b1a80aec27d9d444c430095d.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
b62ea075cfc99980488bc206cba24ffcd4faccd8b1a80aec27d9d444c430095d.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
d6150fd4d9616788fcb6f765ab5052669feaf90ac926ad42a59f3abf4871edb8.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
d6150fd4d9616788fcb6f765ab5052669feaf90ac926ad42a59f3abf4871edb8.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
e6834bbc9946e79f8888d30e52ae72552c37f160a8e6ce3f56ae5a88ed190e91.ps1
Resource
win7-20230220-en
General
-
Target
9700317842.zip
-
Size
14.2MB
-
MD5
94ec9ee095b5917cc90e42f6db30fd6d
-
SHA1
12c880082c28bf2295d303462c9e3fe40f5fedeb
-
SHA256
9bb6a1de7b5d4e99c1fd1068003e09c514772c69f8996e64fc9599e295912c31
-
SHA512
461212aac11071edccdac970d9b0dc6ee498475898fb5e3fd1aa39f35d347ccf5fee65e1400247a74830a318b8255186497af4afd2e1b92911a6ba23caf1cefb
-
SSDEEP
393216:msfUajJhN5bHmNN1oBXZnH1LfP/4CdGrbV:mJajJhNJHOYZnH17P/479
Malware Config
Signatures
-
XMRig Miner payload 4 IoCs
resource yara_rule static1/unpack001/a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7 xmrig static1/unpack001/a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7 family_xmrig static1/unpack001/b62ea075cfc99980488bc206cba24ffcd4faccd8b1a80aec27d9d444c430095d xmrig static1/unpack001/b62ea075cfc99980488bc206cba24ffcd4faccd8b1a80aec27d9d444c430095d family_xmrig -
Xmrig family
Files
-
9700317842.zip.zip
Password: infected
-
0159c3b4fdff4ba89ff9e56bf2cdcdc8aaaa35d1fa4661288225e3701f8569b5.ps1
-
4d3be48fd3dde635cccd87a9925749c5a166e9b52026b5277883c7f3ab50c520
-
55ba36d2ee2c5359dec3a425d27df9c3fb1ddede8cef74fd0bd69d38434609fd.ps1
-
57223450820cbe9cf5779083b7d85c440bb8b529505c55579bfcc5816bf5c80a
-
a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7.exe windows x64
2e3e4d2cfd6226981f42ae1c2abe7b12
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
recv
ntohs
htons
send
WSASetLastError
WSAGetLastError
select
WSARecvFrom
WSASocketW
WSASend
WSARecv
WSAIoctl
gethostname
WSADuplicateSocketW
shutdown
getpeername
FreeAddrInfoW
GetAddrInfoW
htonl
socket
setsockopt
listen
closesocket
bind
WSACleanup
WSAStartup
getsockopt
getsockname
ioctlsocket
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
kernel32
SetConsoleMode
GetConsoleMode
QueryPerformanceFrequency
QueryPerformanceCounter
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
GetConsoleWindow
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetTickCount
CloseHandle
FreeConsole
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetFileType
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
CreateFileA
DuplicateHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
CreateDirectoryW
FlushFileBuffers
GetDiskFreeSpaceW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFinalPathNameByHandleW
GetFullPathNameW
SetUnhandledExceptionFilter
RemoveDirectoryW
SetConsoleTitleA
SetFileTime
GetSystemInfo
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeCriticalSection
SetConsoleCtrlHandler
GetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
CreateIoCompletionPort
ReadDirectoryChangesW
VerSetConditionMask
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTempPathW
GlobalMemoryStatusEx
VerifyVersionInfoA
FileTimeToSystemTime
RtlUnwind
SetHandleInformation
CancelIoEx
CancelIo
SwitchToThread
SetFileCompletionNotificationModes
LoadLibraryExW
FormatMessageA
SetErrorMode
GetQueuedCompletionStatus
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
ResumeThread
GetNativeSystemInfo
CreateSemaphoreA
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
CancelSynchronousIo
GetNamedPipeHandleStateA
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
DebugBreak
GetModuleHandleA
LoadLibraryExA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
GetComputerNameA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
GetStringTypeW
GetStdHandle
WriteConsoleW
SetFilePointerEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetStdHandle
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetFileAttributesExW
SetFileAttributesW
GetConsoleCP
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
ReadFile
K32GetProcessMemoryInfo
InitializeCriticalSectionEx
WaitForSingleObjectEx
GetExitCodeThread
SleepConditionVariableSRW
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
user32
GetProcessWindowStation
GetUserObjectInformationW
ShowWindow
GetLastInputInfo
DispatchMessageA
GetMessageA
GetSystemMetrics
MapVirtualKeyW
TranslateMessage
MessageBoxW
shell32
SHGetSpecialFolderPathA
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
advapi32
SystemFunction036
GetUserNameW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
bcrypt
BCryptGenRandom
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 126KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
b3ceead8490dd68c344d5b009a8bf17ed7d24499a9d66dc3493033b5696f6632.ps1
-
b62ea075cfc99980488bc206cba24ffcd4faccd8b1a80aec27d9d444c430095d.exe windows x64
257db801bf29257f60ad247f0c5bf789
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
htons
WSASend
ntohs
WSAGetLastError
WSARecvFrom
gethostname
WSARecv
WSAIoctl
WSADuplicateSocketW
FreeAddrInfoW
GetAddrInfoW
htonl
listen
bind
getsockname
WSASetLastError
WSACleanup
__WSAFDIsSet
closesocket
select
shutdown
WSASocketW
inet_pton
getaddrinfo
WSAStartup
getpeername
send
socket
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
psapi
GetProcessMemoryInfo
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertOpenStore
CertFreeCertificateContext
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CertGetCertificateContextProperty
kernel32
SetConsoleMode
GetConsoleMode
GetCurrentProcess
CloseHandle
GetComputerNameW
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
GetSystemDefaultLCID
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
SetThreadExecutionState
QueryFullProcessImageNameW
GlobalAlloc
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetTickCount
FreeConsole
GetConsoleWindow
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
GetFileType
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
CreateFileA
DuplicateHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
CreateDirectoryW
FlushFileBuffers
GetDiskFreeSpaceW
RtlLookupFunctionEntry
GetFileInformationByHandle
SetConsoleTitleA
GetFinalPathNameByHandleW
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetFilePointerEx
SetFileTime
GetSystemInfo
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeCriticalSection
SetConsoleCtrlHandler
GetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
CreateIoCompletionPort
ReadDirectoryChangesW
VerSetConditionMask
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTempPathW
GlobalMemoryStatusEx
VerifyVersionInfoA
FileTimeToSystemTime
SetHandleInformation
RtlUnwind
SetFileCompletionNotificationModes
LoadLibraryExW
FormatMessageA
SetErrorMode
GetQueuedCompletionStatus
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
ResumeThread
GetNativeSystemInfo
CreateSemaphoreA
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
CancelIoEx
CancelSynchronousIo
SwitchToThread
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
DebugBreak
GetModuleHandleA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
GetComputerNameA
CreateEventW
GetStringTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
SleepConditionVariableSRW
GetStdHandle
WriteConsoleW
GetFileSizeEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetStdHandle
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetFileAttributesExW
SetFileAttributesW
GetConsoleOutputCP
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetFileAttributesW
CancelIo
InitOnceBeginInitialize
InitOnceComplete
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
WaitForSingleObjectEx
GetExitCodeThread
user32
GetWindowTextW
GetSystemMetrics
MapVirtualKeyW
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
ShowWindow
GetLastInputInfo
GetWindowThreadProcessId
GetWindowTextLengthW
GetForegroundWindow
shell32
SHQueryUserNotificationState
SHGetFolderPathW
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
oleaut32
SysFreeString
VarUI8FromStr
SysAllocString
VariantClear
advapi32
SystemFunction036
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
LsaOpenPolicy
LsaAddAccountRights
LsaClose
CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptImportKey
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetUserNameW
GetTokenInformation
bcrypt
BCryptGenRandom
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 67KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_SHA3_25 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
d6150fd4d9616788fcb6f765ab5052669feaf90ac926ad42a59f3abf4871edb8.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
e6834bbc9946e79f8888d30e52ae72552c37f160a8e6ce3f56ae5a88ed190e91.ps1