2849f85d2daef62963c2ceecbb1586a9aac840b545549c80dc37d54b410f7f0b

Sharing

Copy URL Twitter E-mail

General

Target

2849f85d2daef62963c2ceecbb1586a9aac840b545549c80dc37d54b410f7f0b
Size

263KB
MD5

2bbc343695c97851bd2655dacbe4656a
SHA1

bdf35394963d4425efa1492550c1837ceb29adc3
SHA256

2849f85d2daef62963c2ceecbb1586a9aac840b545549c80dc37d54b410f7f0b
SHA512

8f06291b9856be631951508a78194d3a7bef8b46dc0d44923f479d79b9378502203423542f1d410eae67893d8e7ad90f8b4a9817b90a41a5b8c24073096bad17
SSDEEP

6144:gUdx9tFvhueMEM1ttx2gYVAjclDygHUpvi2t/woI9L:T/bFvYnbLYlDygHUJi2p9I9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2849f85d2daef62963c2ceecbb1586a9aac840b545549c80dc37d54b410f7f0b

Files

2849f85d2daef62963c2ceecbb1586a9aac840b545549c80dc37d54b410f7f0b
.exe windows x64

c0f38c7a097c0da19f3c9ee262456118

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
Process32NextW
LockResource
Process32FirstW
HeapReAlloc
CloseHandle
CreateThread
LoadResource
FindResourceW
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
GetTickCount
LoadLibraryExW
GetACP
LoadLibraryW
LocalFree
ExitProcess
ExitThread
VirtualFree
HeapSize
GetTempPathW
CompareStringOrdinal
LoadLibraryExA
GetFinalPathNameByHandleW
SizeofResource
HeapFree
FindStringOrdinal
WTSGetActiveConsoleSessionId

user32

GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation

advapi32

RegEnumValueW
ConvertSidToStringSidW
RegDeleteValueW
LookupAccountNameW
RegOpenKeyExW
RegDeleteKeyValueW
RegQueryInfoKeyW
RegCloseKey
RegGetValueW

ntdll

NtQueryDirectoryFile
NtShutdownSystem
��H�\$ D�D$�L$UVWATAUAVAWH��H��@H�]h��L�epE3�H�M`M��L�mxH�M�$$� �MHH�]�L�e�L�u�M��
RtlAdjustPrivilege
RtlCompareUnicodeString
NtDeleteKey
NtOpenProcessToken
NtQueryVirtualMemory
NtSetIoCompletion
NtCreateSection
_wcsicmp
RtlRandomEx
swprintf_s
sprintf_s
NtQueryInformationProcess
NtDeleteFile
NtQueryInformationToken
strncpy
NtClose
$�L$UVWATAUAVAWH��H��@H�]h��L�epE3�H�M`M��L�mxH�M�$$� �MHH�]�L�e�L�u�M��
NtCreateEvent
NtCreateKey
NtWaitForSingleObject
NtOpenFile
NtLoadDriver
NtQuerySystemInformation
NtTerminateThread
NtCreateIoCompletion

wintrust

WinVerifyTrust

l�c@� ��h�\$ d�d$�l$uvwatauavawh��h��@h�]h��l�epe3�h�m`m��l�mxh�m�$$� �mhh�]�l�e�l�u�m��

WTSQuerySessionInforma��*��A�� M
�� M

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0f38c7a097c0da19f3c9ee262456118

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ntdll

wintrust

l�c@� ������������h�\$ d�d$�l$uvwatauavawh��h��@h�]h��l�epe3�h�m`m��l�mxh�m�$$� �mhh�]�l�e�l�u�m����

Sections

.text Size: 64KB - Virtual size: 64KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 26KB

.pdata Size: 1024B - Virtual size: 840B

.rsrc Size: 188KB - Virtual size: 187KB

l�c@� ��h�\$ d�d$�l$uvwatauavawh��h��@h�]h��l�epe3�h�m`m��l�mxh�m�$$� �mhh�]�l�e�l�u�m��

.text
Size: 64KB - Virtual size: 64KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 26KB

.pdata
Size: 1024B - Virtual size: 840B

.rsrc
Size: 188KB - Virtual size: 187KB