09d965c11f1cc40ff6e2214a4fa4ca59597287da27e481e182e3549a57119106

Sharing

Copy URL Twitter E-mail

General

Target

09d965c11f1cc40ff6e2214a4fa4ca59597287da27e481e182e3549a57119106
Size

178KB
MD5

9715d405438646d830d89c1e44d53611
SHA1

b79bd94b441ec43df0d8adfa765dc0360f78b847
SHA256

09d965c11f1cc40ff6e2214a4fa4ca59597287da27e481e182e3549a57119106
SHA512

5d0fd954fb4a570346519dbe045bb9fe65aad3eb15a5a8c560454c073f4ab1b92bbffe0fadd0f257db58429a4d0085455292ec8071eef65c0367a53b284d7cf4
SSDEEP

3072:P0XTCydtzQbAddytdLyTO7IrxU2OspKhtDAUV7gstfV+CsgKub:8XTCuQAddGLF7YxHpWAUtgshV+CN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09d965c11f1cc40ff6e2214a4fa4ca59597287da27e481e182e3549a57119106

Files

09d965c11f1cc40ff6e2214a4fa4ca59597287da27e481e182e3549a57119106
.exe windows x64

9de8ac8735351f31e233d29b3bdcb999

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
Process32NextW
LockResource
Process32FirstW
HeapReAlloc
CloseHandle
CreateThread
LoadResource
FindResourceW
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
GetTickCount
LoadLibraryExW
GetACP
LoadLibraryW
LocalFree
ExitProcess
ExitThread
VirtualFree
HeapSize
GetTempPathW
CompareStringOrdinal
LoadLibraryExA
GetFinalPathNameByHandleW
SizeofResource
HeapFree
FindStringOrdinal
WTSGetActiveConsoleSessionId

user32

GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation

advapi32

RegEnumValueW
ConvertSidToStringSidW
RegDeleteValueW
LookupAccountNameW
RegOpenKeyExW
RegDeleteKeyValueW
RegQueryInfoKeyW
RegCloseKey
RegGetValueW

ntdll

NtQueryDirectoryFile
NtShutdownSystem
memcpy
RtlAdjustPrivilege
RtlCompareUnicodeString
NtDeleteKey
NtOpenProcessToken
NtQueryVirtualMemory
NtSetIoCompletion
NtCreateSection
_wcsicmp
RtlRandomEx
swprintf_s
sprintf_s
NtQueryInformationProcess
NtDeleteFile
NtQueryInformationToken
strncpy
NtClose
memset
NtCreateEvent
NtCreateKey
NtWaitForSingleObject
NtOpenFile
NtLoadDriver
NtQuerySystemInformation
NtTerminateThread
NtCreateIoCompletion

wintrust

WinVerifyTrust

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9de8ac8735351f31e233d29b3bdcb999

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ntdll

wintrust

wtsapi32

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 26KB

.pdata Size: 1024B - Virtual size: 840B

.rsrc Size: 106KB - Virtual size: 105KB

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 26KB

.pdata
Size: 1024B - Virtual size: 840B

.rsrc
Size: 106KB - Virtual size: 105KB