AtBroker[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

AtBroker.exe
Size

70KB
MD5

46a7e0b5ff9478a81ebf1b4288d25c10
SHA1

50a4dee759fba62fa61d1fe6ffdbdd9ebce2d57b
SHA256

395987b52a63440006d9d109b170d777d1f790b0ec67767f0f54ec2e25afd84c
SHA512

ad3f33f44a1675529d3697af834ad4d1fdd97a53d2e1f0e3c46bc4771559eac665583528d4c3a8c2aeebd36b8ff3dd0b8e66461edaa2d94b9bed382c28360dfa
SSDEEP

1536:SeJ76IVLG27BB67vF6V4+mmM5IzsNPfbdtm2CxtYH6H:rJmKLGKO7N/uwIzm5tm2Cxt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AtBroker.exe

Files

AtBroker.exe
.exe windows x86

51448dbd5effe0bf292bd607225260c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
OpenServiceW
QueryServiceConfigW
EventUnregister
RegOpenKeyExW
CheckTokenMembership
UnregisterTraceGuids
RegisterTraceGuidsW
FreeSid
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
EventSetInformation
TraceMessage
AllocateAndInitializeSid
OpenSCManagerW
EventRegister
CloseServiceHandle
EventWriteTransfer
RegCloseKey

kernel32

GetModuleFileNameA
SizeofResource
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
ExpandEnvironmentStringsW
SetProcessShutdownParameters
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
LocalAlloc
GetCurrentThreadId
GetVersionExW
ReleaseMutex
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
LockResource
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
RaiseException
CreateThreadpoolTimer
FindResourceExW
LoadResource
HeapAlloc
GetProcAddress
CreateMutexExW
LocalFree
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
lstrcmpiW
OpenMutexW
IsDebuggerPresent
IsProcessInJob
OpenJobObjectW
InitOnceComplete
InitOnceBeginInitialize
RegEnumValueW
RegDeleteTreeW
K32GetModuleBaseNameW
K32EnumProcessModules
ProcessIdToSessionId
K32EnumProcesses
RegLoadMUIStringW
DeleteFileW
GetFileAttributesW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
OpenProcess
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSection
HeapDestroy
HeapReAlloc
HeapSize

user32

SystemParametersInfoW
GetUserObjectInformationW
SendNotifyMessageW
GetWindowThreadProcessId
UnregisterClassA
SendInput
SetDesktopColorTransform
GetThreadDesktop
GetKeyState
GetShellWindow

msvcrt

_controlfp
?terminate@@YAXXZ
_callnewh
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
_exit
exit
__set_app_type
_amsg_exit
__p__commode
_XcptFilter
??_V@YAXPAX@Z
malloc
memmove_s
free
_purecall
wcscpy_s
_wcsicmp
memcpy_s
_vsnwprintf
??1type_info@@UAE@XZ
__wgetmainargs
memcmp
_cexit
__CxxFrameHandler3
_wtoi
wcsrchr
wcsspn
wcscspn
_wcslwr_s
_ltow_s
memset

ntdll

WinSqmIsOptedIn
WinSqmAddToStream
NtQueryWnfStateData

shell32

ShellExecuteW

shlwapi

PathFileExistsW
ord460

uxtheme

ord65

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51448dbd5effe0bf292bd607225260c3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

shell32

shlwapi

uxtheme

Sections

.text Size: 57KB - Virtual size: 56KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 57KB - Virtual size: 56KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB