b17b54e8518896d05c5d637202df6d67596d250e9b54bf6925bc07fdf49026f8

Sharing

Copy URL

Twitter E-mail

General

Target

b17b54e8518896d05c5d637202df6d67596d250e9b54bf6925bc07fdf49026f8
Size

234KB
MD5

61be9fcd129058c5453d17993837bf57
SHA1

0df711ead714157be8827465095fe5c1c635ec79
SHA256

b17b54e8518896d05c5d637202df6d67596d250e9b54bf6925bc07fdf49026f8
SHA512

7337250e8bee1babdb5875f91c125e93ffda670851abeffee1db0323e2835765244f0e73b20a531d72dad1f2b7c57d805acf19d08c98dffd06f32b5782f4bf2b
SSDEEP

3072:Xr5XE/WQrzdQHD3lSTF/pstBaDqwONnct437Bl3N2U9jZNh2:NXeWblkF/p/uwONct43j92U9lNw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b17b54e8518896d05c5d637202df6d67596d250e9b54bf6925bc07fdf49026f8

Files

b17b54e8518896d05c5d637202df6d67596d250e9b54bf6925bc07fdf49026f8
.exe windows x64

3eb67785e8ada1e43c9e93e5b79fb60a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mfc140u

ord7037
ord2155
ord457
ord1094
ord528
ord1149
ord746
ord1284
ord7236
ord8990
ord3171
ord3124
ord8172
ord8441
ord4086
ord6361
ord3803
ord2187
ord2479
ord12448
ord4725
ord2176
ord4957
ord13269
ord5046
ord5047
ord11224
ord7785
ord13301
ord8969
ord7637
ord13199
ord7928
ord2222
ord6920
ord632
ord14129
ord2593
ord13759
ord13761
ord11857
ord2270
ord878
ord1369
ord12706
ord4030
ord11061
ord3745
ord6247
ord4656
ord1033
ord296
ord3756
ord6320
ord2475
ord3089
ord4724
ord2749
ord8088
ord6466
ord12814
ord8900
ord5845
ord3812
ord11806
ord5723
ord13354
ord11402
ord4817
ord4766
ord4751
ord4809
ord4856
ord4779
ord4831
ord4846
ord4791
ord4797
ord4803
ord4785
ord4840
ord4770
ord1752
ord1725
ord1747
ord1721
ord1699
ord8938
ord11890
ord14198
ord3718
ord11771
ord7913
ord5143
ord7885
ord8016
ord7946
ord8036
ord2669
ord2649
ord5259
ord4245
ord3892
ord4633
ord13942
ord2061
ord12163
ord3218
ord8686
ord8631
ord13827
ord6077
ord8148
ord12674
ord8505
ord3043
ord14063
ord10778
ord3245
ord11020
ord1751
ord3985
ord2044
ord4918
ord4923
ord3045
ord6057
ord12891
ord11830
ord3877
ord2619
ord8497
ord13944
ord7857
ord13143
ord10851
ord8693
ord8647
ord3137
ord3263
ord2565
ord2090
ord10819
ord2978
ord8982
ord8688
ord8646
ord8653
ord12357
ord13150
ord3876
ord4367
ord10953
ord13927
ord3259
ord12506
ord8086
ord8174
ord12987
ord7773
ord7774
ord7802
ord12332
ord12297
ord6229
ord8388
ord8381
ord3484
ord789
ord8391
ord8392
ord8396
ord3702
ord12551
ord5630
ord5590
ord12991
ord12418
ord2647
ord12555
ord7631
ord14017
ord11904
ord8535
ord11056
ord10053
ord11579
ord8778
ord8797
ord2603
ord4040
ord4053
ord2215
ord1709
ord9675
ord9197
ord9202
ord9212
ord8554
ord4559
ord2071
ord4128
ord3237
ord9073
ord4229
ord8714
ord1961
ord13803
ord2606
ord8629
ord12649
ord8123
ord13884
ord6289
ord12798
ord4755
ord4745
ord1711
ord8947
ord7886
ord8038
ord7921
ord6852
ord4988
ord5254
ord2640
ord4254
ord3908
ord8685
ord8630
ord13828
ord8136
ord12661
ord14062
ord11444
ord11010
ord2581
ord3971
ord3903
ord7855
ord8691
ord8648
ord13983
ord10818
ord2976
ord11173
ord9357
ord8645
ord3874
ord4365
ord13925
ord3074
ord3073
ord3247
ord7618
ord2632
ord13881
ord5256
ord2496
ord3533
ord3909
ord3894
ord14095
ord12942
ord8255
ord3044
ord13932
ord4041
ord2075
ord11417
ord13912
ord12997
ord2699
ord2721
ord11286
ord12820
ord11824
ord3029
ord8727
ord8842
ord8790
ord4455
ord8753
ord8328
ord2344
ord2365
ord9442
ord8690
ord11403
ord12627
ord12508
ord2915
ord6724
ord7910
ord7933
ord12883
ord4862
ord13522
ord11672
ord3293
ord3329
ord13657
ord3090
ord5102
ord7255
ord2109
ord550
ord1169
ord622
ord1218
ord742
ord1280
ord767
ord1297
ord5549
ord8997
ord551
ord4268
ord8251
ord8161
ord13767
ord4232
ord7741
ord3122
ord13282
ord4244
ord3887
ord13360
ord4209
ord2010
ord4336
ord4294
ord8226
ord8387
ord8070
ord13733
ord4696
ord3143
ord2340
ord12030
ord14225
ord12087
ord14278
ord6505
ord12957
ord8468
ord11791
ord2212
ord14143
ord13865
ord777
ord4329
ord11375
ord2514
ord4357
ord13109
ord7048
ord7051
ord8224
ord7054
ord7049
ord7052
ord7053
ord7055
ord13626
ord7050
ord14279
ord8099
ord7472
ord4349
ord8908
ord14213
ord7647
ord1298
ord11865
ord11825
ord4874
ord12145
ord1766
ord13361
ord13359
ord11122
ord5743
ord8523
ord9045
ord11493
ord11488
ord3725
ord3185
ord7540
ord2049
ord10531
ord11182
ord2969
ord13965
ord11105
ord11199
ord1832
ord8896
ord9411
ord11193
ord2039
ord8124
ord12639
ord3232
ord3341
ord5540
ord9835
ord9838
ord9842
ord7393
ord984
ord1451
ord12923
ord7716
ord2273
ord2269
ord2178
ord4317
ord13545
ord8159
ord7673
ord7718
ord7739
ord13709
ord7416
ord7047
ord804
ord1844
ord365
ord1059
ord11709
ord11928
ord13864
ord2288
ord4446
ord450
ord1089
ord6250
ord1091
ord7235
ord3951
ord1893
ord6615
ord9941
ord5555
ord12606
ord11901
ord11933
ord10124
ord7920
ord11929
ord11921
ord5706
ord3731
ord6122
ord14289
ord6123
ord14290
ord6121
ord14288
ord7719
ord12212
ord14088
ord11665
ord11664
ord2011
ord7668
ord12625
ord3949
ord4011
ord9089
ord14216
ord7650
ord14210
ord12223
ord12222
ord2439
ord5183
ord8023
ord12544
ord8084
ord8167
ord8158
ord2725
ord12685
ord11582
ord13846
ord8665
ord8899
ord8176
ord13937
ord12264
ord6287
ord8901
ord8926
ord11855
ord2697
ord13397
ord6000

kernel32

InitializeCriticalSectionEx
GetLastError
EnterCriticalSection
DeleteCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringW
LocalFree
LeaveCriticalSection
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
InitializeCriticalSectionAndSpinCount
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime

user32

SetRectEmpty
LoadMenuW
SendMessageW
ScreenToClient
GetClientRect
InvalidateRect
UpdateWindow
GetWindowRect
InflateRect
GetSysColor
LoadBitmapW
EnableWindow
IsChild
GetFocus
LoadImageW
GetSystemMetrics
RedrawWindow
ClientToScreen
IsIconic
GetParent
GetSubMenu

gdi32

CreateFontIndirectW
DeleteObject
GetStockObject
GetObjectW

comctl32

InitCommonControlsEx
ImageList_AddMasked

oleaut32

SysAllocString
VariantClear

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall
memset
__C_specific_handler
__std_terminate
__current_exception_context
_CxxThrowException
__current_exception
memcpy

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
terminate
_crt_atexit
_c_exit
_cexit
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3eb67785e8ada1e43c9e93e5b79fb60a

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

comctl32

oleaut32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 42KB - Virtual size: 42KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 123KB - Virtual size: 123KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 42KB - Virtual size: 42KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 123KB - Virtual size: 123KB

.reloc
Size: 6KB - Virtual size: 5KB