1d30cdecdc4d2d861e5450f2a6a916d130884d592ac82af51969d067c9d53112

Sharing

Copy URL Twitter E-mail

General

Target

1d30cdecdc4d2d861e5450f2a6a916d130884d592ac82af51969d067c9d53112
Size

287KB
MD5

fb3d81437897938513b2ee797382bf9c
SHA1

aea4bdffe3df9666ed3704b4fd384aabc184b686
SHA256

1d30cdecdc4d2d861e5450f2a6a916d130884d592ac82af51969d067c9d53112
SHA512

2de2e5b11d6db70bc2fe99c038d9fbc0762e46155a89048a5156ef3f3fec9c4577137d0f8578bc005d3b43356c0d3e5132d6a680f8f3c9649636343f1ea21221
SSDEEP

3072:BCHbuq0/DtvYM+GKu+DaTzsNzEIB4+zE3G5a/mVE//G5bP9863gKLUmQWu3Gwip9:47u5xUG+DaTINCpXG9V8CImQWu3Gtfe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d30cdecdc4d2d861e5450f2a6a916d130884d592ac82af51969d067c9d53112

Files

1d30cdecdc4d2d861e5450f2a6a916d130884d592ac82af51969d067c9d53112
.exe windows x64

c100b8f3ef9519400d99c80a8345f5a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegEnumValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegFlushKey

kernel32

HeapSize
RaiseException
ExpandEnvironmentStringsW
ReadProcessMemory
WTSGetActiveConsoleSessionId
LocalFree
GetCurrentProcessId
ProcessIdToSessionId
GetVersionExW
GetSystemInfo
HeapAlloc
HeapCreate
GetCommandLineW
SetProcessShutdownParameters
HeapSetInformation
CompareStringW
CloseHandle
GetLastError
GetCommandLineA
GetStartupInfoW
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetCurrentThreadId
FlsAlloc
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
CreateMutexW
HeapFree
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetCPInfo
GetACP
GetOEMCP
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringW
GetStringTypeW
HeapReAlloc
SetStdHandle
WriteConsoleW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
VirtualQuery
CreateFileW
FlushFileBuffers
TlsGetValue
GetModuleHandleExW
WaitForSingleObject
SetEvent
InitializeCriticalSection
TlsSetValue
LoadLibraryW
ResetEvent
OpenThread
LocalAlloc
CreateEventW
WaitForMultipleObjects
TlsAlloc
TlsFree
CreateThread
SwitchToThread
FreeLibraryAndExitThread
lstrcmpiW
OpenEventW
GetProcessId
OpenProcess
GetExitCodeProcess
lstrcmpW
WaitForSingleObjectEx
QueueUserAPC
ReadFileEx
CancelIo
GetOverlappedResult
GlobalAddAtomW
GlobalDeleteAtom
UnhandledExceptionFilter

atl

ord16
ord21

ntdll

NtClose
RtlCopyLuid
NtQuerySystemInformation
RtlMultiByteToUnicodeN
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtOpenProcessToken
NtQueryInformationProcess
NtQueryInformationToken

shell32

ShellExecuteExW
SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoUninitialize

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelQuery
WTSLogoffSession

gdi32

DeleteObject
CreateDCW
DeleteDC
ExtEscape
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectW
GetRegionData
CreateRectRgn

user32

CreateWindowExW
RegisterClassExW
GetClassInfoExW
UnregisterClassW
LoadCursorW
SetWindowLongPtrW
GetWindowLongPtrW
LoadStringW
MessageBoxW
LockWorkStation
SystemParametersInfoW
SwapMouseButton
SetWinEventHook
UnhookWinEvent
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
OpenDesktopW
SetThreadDesktop
IsWindow
IsWindowVisible
GetDesktopWindow
GetParent
GetWindow
MsgWaitForMultipleObjectsEx
GetWindowThreadProcessId
RedrawWindow
GetWindowRect
DefWindowProcW
GetClassLongW
GetGUIThreadInfo
GetAncestor
EnumThreadWindows
GetWindowRgnBox
GetWindowRgn
GetWindowInfo
SendMessageTimeoutW
GetClassLongPtrW
GetCursorPos
GetSystemMetrics
MoveWindow
EnumDisplayDevicesW
PostThreadMessageW
GetAsyncKeyState
RegisterHotKey
UnregisterHotKey
MapVirtualKeyW
SendInput
SetForegroundWindow
DestroyIcon
DestroyWindow
DispatchMessageW
PeekMessageW
GetIconInfo
PostMessageW
CopyImage
GetClassNameW
EnumWindows

winsta

WinStationVirtualOpenEx
WinStationQueryInformationW
WinStationGetConnectionProperty
WinStationVerify

rpcrt4

RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFromStringBindingW
I_RpcExceptionFilter
RpcBindingFree
NdrClientCall3
RpcStringBindingComposeW

shlwapi

PathUnquoteSpacesW

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c100b8f3ef9519400d99c80a8345f5a2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

atl

ntdll

shell32

ole32

wtsapi32

gdi32

user32

winsta

rpcrt4

shlwapi

Sections

.text Size: 265KB - Virtual size: 265KB

.data Size: 7KB - Virtual size: 16KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 265KB - Virtual size: 265KB

.data
Size: 7KB - Virtual size: 16KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 3KB