dde0cf05ffb16ebbf92cb88653cc4ca1bb257aead013ba632615659eace8e297

Sharing

Copy URL Twitter E-mail

General

Target

dde0cf05ffb16ebbf92cb88653cc4ca1bb257aead013ba632615659eace8e297
Size

263KB
MD5

211385974044060c7401cc7adccd8ed7
SHA1

509267c3aaaad1472f5996aa24db6795a270673b
SHA256

dde0cf05ffb16ebbf92cb88653cc4ca1bb257aead013ba632615659eace8e297
SHA512

59ac7bb69520268bcb91ed686f0c88bf4fe53fd4b009c4f4bef7901c33d8e72ed54f91f4ed7c7930f532bfd31ea39905c3c9155370eb7dd148e04b71cef411e4
SSDEEP

6144:e4G1p1EM1ttx2gYVAjclDygHUpvi2t/woI9L:zG19bLYlDygHUJi2p9I9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dde0cf05ffb16ebbf92cb88653cc4ca1bb257aead013ba632615659eace8e297

Files

dde0cf05ffb16ebbf92cb88653cc4ca1bb257aead013ba632615659eace8e297
.exe windows x64

e5e545a7d0b8d84df3b892d1807c00f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
Process32NextW
LockResource
Process32FirstW
HeapReAlloc
CloseHandle
CreateThread
LoadResource
FindResourceW
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
GetTickCount
LoadLibraryExW
GetACP
LoadLibraryW
LocalFree
ExitProcess
ExitThread
VirtualFree
HeapSize
GetTempPathW
CompareStringOrdinal
LoadLibraryExA
GetFinalPathNameByHandleW
SizeofResource
HeapFree
FindStringOrdinal
WTSGetActiveConsoleSessionId

user32

GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation

advapi32

RegEnumValueW
ConvertSidToStringSidW
RegDeleteValueW
LookupAccountNameW
RegOpenKeyExW
RegDeleteKeyValueW
RegQueryInfoKeyW
RegCloseKey
RegGetValueW

ntdll

NtQueryDirectoryFile
NtShutdownSystem
RtlAdjustPrivilege
RtlCompareUnicodeString
NtDeleteKey
NtOpenProcessToken
NtQueryVirtualMemory
NtSetIoCompletion
NtCreateSection
_wcsicmp
RtlRandomEx
swprintf_s
sprintf_s
NtQueryInformationProcess
NtDeleteFile
NtQueryInformationToken
strncpy
NtClose
E3�H�L$(��
NtCreateEvent
NtCreateKey
NtWaitForSingleObject
NtOpenFile
NtLoadDriver
NtQuerySystemInformation
NtTerminateThread
NtCreateIoCompletion

wintrust

WinVerifyTrust

(��h�u�h��h��

WTSQuerySessionInforma�H�D$ D�K8E3�H��W(��H�u�H��H��
K8E3�H��W(��H�u�H��H��

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5e545a7d0b8d84df3b892d1807c00f3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ntdll

wintrust

(��h�u�h��h����

Sections

.text Size: 64KB - Virtual size: 64KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 26KB

.pdata Size: 1024B - Virtual size: 840B

.rsrc Size: 188KB - Virtual size: 187KB

(��h�u�h��h��

.text
Size: 64KB - Virtual size: 64KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 26KB

.pdata
Size: 1024B - Virtual size: 840B

.rsrc
Size: 188KB - Virtual size: 187KB