AtBroker[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

AtBroker.exe
Size

43KB
MD5

fae22e6898713b4b42ba2716ef98f96f
SHA1

7a19e327fe821b5213f78d66eb467bb9855102c3
SHA256

9e71607479cf64e9c343bd525f3f241fb10bb53e500c1f76ba538d3ef6139b46
SHA512

0734e05288313ff9178e986f5ff0ee847e271fe719ecb6d510d8dafd8c91da0cfee7b311101509152d4937b0f8ccd56dcc7e12a1671da8707b9c2db55becb1ef
SSDEEP

768:LSZynr22lTSUTZ5KGrBB2waawoMOzAynI3MrbyAnnJ5NaLDc9:R5131B2owWzznI3M3JvaLDc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AtBroker.exe

Files

AtBroker.exe
.exe windows x86

a65d68539efbe4466b7454eb20f03f84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
OpenServiceW
QueryServiceConfigW
RegOpenKeyExW
CheckTokenMembership
UnregisterTraceGuids
RegisterTraceGuidsW
FreeSid
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
AllocateAndInitializeSid
OpenSCManagerW
CloseServiceHandle
RegCloseKey
TraceMessage

kernel32

SetProcessShutdownParameters
LocalAlloc
GetCurrentThreadId
GetVersionExW
Sleep
CloseHandle
LocalFree
ExpandEnvironmentStringsW
OpenMutexW
LeaveCriticalSection
EnterCriticalSection
RaiseException
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
lstrcmpiW
IsProcessInJob
OpenJobObjectW
RegEnumValueW
RegDeleteTreeW
RegNotifyChangeKeyValue
K32GetModuleBaseNameW
K32EnumProcessModules
ProcessIdToSessionId
K32EnumProcesses
RegLoadMUIStringW
FindResourceExW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
DeleteFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetLastError
OpenProcess
InitializeProcThreadAttributeList
HeapAlloc
GetProcessHeap
UpdateProcThreadAttribute
CreateProcessW
DeleteProcThreadAttributeList
HeapFree
GetFileAttributesW

user32

SendNotifyMessageW
SendInput
GetShellWindow
GetWindowThreadProcessId
SystemParametersInfoW
GetUserObjectInformationW
GetThreadDesktop
GetKeyState
UnregisterClassA

msvcrt

_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
_wtoi
wcsrchr
_vsnwprintf
wcsspn
wcscspn
_lock
memmove_s
_wcslwr_s
_ltow_s
_callnewh
memset
??1type_info@@UAE@XZ
_unlock
__dllonexit
_onexit
_CxxThrowException
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
malloc
free
wcscpy_s
_wcsicmp
memcpy_s
__CxxFrameHandler3

ntdll

NtQueryWnfStateData
WinSqmAddToStream
WinSqmIsOptedIn

shell32

ShellExecuteW

shlwapi

ord460
PathFileExistsW

uxtheme

ord65

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a65d68539efbe4466b7454eb20f03f84

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

shell32

shlwapi

uxtheme

Sections

.text Size: 34KB - Virtual size: 33KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 34KB - Virtual size: 33KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB