AtBroker[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

AtBroker.exe
Size

70KB
MD5

bcbe6a4ec9c325c3cb289c4389ffca18
SHA1

1e57f2b5141b303c73e310fe6e2532c061e40bb6
SHA256

242bed41754c0ffd44a6f1d8696ab4ebf553a03a5a4439a037c1ef4f04d4b989
SHA512

d9f72c8fe5817fff914e76c5e9939f3246ee8307b709780504f9d6ab6c2dd5251d099da68ad027be761de7854027c55fdb301ba48bcb2a226c1c6b152f5933dc
SSDEEP

1536:KI/+16pcVrLEIqUY33FeHWWid5S0EB9Oo4MIR2pxTjK:J/Jp+rLERUie7AS3x4MIR2pxTj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AtBroker.exe

Files

AtBroker.exe
.exe windows x86

51448dbd5effe0bf292bd607225260c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
OpenServiceW
QueryServiceConfigW
EventUnregister
RegOpenKeyExW
CheckTokenMembership
UnregisterTraceGuids
RegisterTraceGuidsW
FreeSid
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
EventSetInformation
TraceMessage
AllocateAndInitializeSid
OpenSCManagerW
EventRegister
CloseServiceHandle
EventWriteTransfer
RegCloseKey

kernel32

GetModuleFileNameA
SizeofResource
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
ExpandEnvironmentStringsW
SetProcessShutdownParameters
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
LocalAlloc
GetCurrentThreadId
GetVersionExW
ReleaseMutex
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
LockResource
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
RaiseException
CreateThreadpoolTimer
FindResourceExW
LoadResource
HeapAlloc
GetProcAddress
CreateMutexExW
LocalFree
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
lstrcmpiW
OpenMutexW
IsDebuggerPresent
IsProcessInJob
OpenJobObjectW
InitOnceComplete
InitOnceBeginInitialize
RegEnumValueW
RegDeleteTreeW
K32GetModuleBaseNameW
K32EnumProcessModules
ProcessIdToSessionId
K32EnumProcesses
RegLoadMUIStringW
DeleteFileW
GetFileAttributesW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
OpenProcess
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSection
HeapDestroy
HeapReAlloc
HeapSize

user32

SystemParametersInfoW
GetUserObjectInformationW
SendNotifyMessageW
GetWindowThreadProcessId
UnregisterClassA
SendInput
SetDesktopColorTransform
GetThreadDesktop
GetKeyState
GetShellWindow

msvcrt

_controlfp
?terminate@@YAXXZ
_callnewh
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
_exit
exit
__set_app_type
_amsg_exit
__p__commode
_XcptFilter
??_V@YAXPAX@Z
malloc
memmove_s
free
_purecall
wcscpy_s
_wcsicmp
memcpy_s
_vsnwprintf
??1type_info@@UAE@XZ
__wgetmainargs
memcmp
_cexit
__CxxFrameHandler3
_wtoi
wcsrchr
wcsspn
wcscspn
_wcslwr_s
_ltow_s
memset

ntdll

WinSqmIsOptedIn
WinSqmAddToStream
NtQueryWnfStateData

shell32

ShellExecuteW

shlwapi

PathFileExistsW
ord460

uxtheme

ord65

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51448dbd5effe0bf292bd607225260c3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

shell32

shlwapi

uxtheme

Sections

.text Size: 57KB - Virtual size: 56KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 57KB - Virtual size: 56KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB