e60f345565da1da7abf649a5bb14cc2e6268a7defd5201930231057f5bd61a3d

Sharing

Copy URL

Twitter E-mail

General

Target

e60f345565da1da7abf649a5bb14cc2e6268a7defd5201930231057f5bd61a3d
Size

234KB
MD5

b8455f77bbd886e0e53946f043293d97
SHA1

d05d22cef523daf7f127ab5ad177d3f51b4f080a
SHA256

e60f345565da1da7abf649a5bb14cc2e6268a7defd5201930231057f5bd61a3d
SHA512

cb45dfb37d3734f229a8fb79ed2f06b32852757f3abe073a0058ddf3c4aebee0df05ee6e1bf81d719251a446973897513216a29b402e3fc275ba8f8704df3202
SSDEEP

3072:VpN+iHQy8m5yUqR6F/pstBaDqwONnct437Bl3N2U9jZ4Mm:KyxqR6F/p/uwONct43j92U9l49

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e60f345565da1da7abf649a5bb14cc2e6268a7defd5201930231057f5bd61a3d

Files

e60f345565da1da7abf649a5bb14cc2e6268a7defd5201930231057f5bd61a3d
.exe windows x64

4f2099b81825c117824f75918dd94946

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mfc140u

ord8313
ord11825
ord9265
ord4349
ord7037
ord2155
ord457
ord1094
ord528
ord1149
ord746
ord1284
ord7236
ord8990
ord3171
ord3124
ord8172
ord8441
ord4086
ord6361
ord3803
ord2187
ord2479
ord12448
ord4725
ord2176
ord4957
ord13269
ord5046
ord5047
ord11224
ord7785
ord13301
ord8969
ord7637
ord13199
ord7928
ord2222
ord6920
ord632
ord14129
ord2593
ord13759
ord13761
ord11857
ord2270
ord878
ord1369
ord12706
ord4030
ord11061
ord3745
ord6247
ord4656
ord1033
ord296
ord3756
ord6320
ord2475
ord3089
ord4724
ord2749
ord8088
ord6466
ord12814
ord8900
ord5845
ord3812
ord11806
ord5723
ord13354
ord11402
ord4817
ord4766
ord4751
ord4809
ord4856
ord4779
ord4831
ord4846
ord4791
ord4797
ord4803
ord4785
ord4840
ord4770
ord1752
ord1725
ord1747
ord1721
ord1699
ord8938
ord11890
ord14198
ord3718
ord11771
ord7913
ord5143
ord7885
ord8016
ord7946
ord8036
ord2669
ord2649
ord5259
ord4245
ord3892
ord4633
ord13942
ord2061
ord12163
ord3218
ord8686
ord8631
ord13827
ord6077
ord8148
ord12674
ord8505
ord3043
ord14063
ord10778
ord3245
ord11020
ord1751
ord3985
ord2044
ord4918
ord4923
ord3045
ord6057
ord12891
ord11830
ord3877
ord2619
ord8497
ord13944
ord7857
ord13143
ord10851
ord8693
ord8647
ord3137
ord3263
ord2565
ord2090
ord10819
ord2978
ord8982
ord8688
ord8646
ord8653
ord12357
ord13150
ord3876
ord4367
ord10953
ord13927
ord3259
ord12506
ord8086
ord8174
ord12987
ord7773
ord7774
ord7802
ord12332
ord12297
ord6229
ord8388
ord8381
ord3484
ord789
ord8391
ord8392
ord8396
ord3702
ord12551
ord5630
ord5590
ord12991
ord12418
ord2647
ord12555
ord7631
ord14017
ord11904
ord8535
ord11056
ord10053
ord11579
ord8778
ord8797
ord2603
ord4040
ord4053
ord2215
ord1709
ord9675
ord9197
ord9202
ord9212
ord8554
ord4559
ord2071
ord4128
ord3237
ord9073
ord4229
ord8714
ord1961
ord13803
ord2606
ord8629
ord12649
ord8123
ord13884
ord6289
ord12798
ord4755
ord4745
ord1711
ord8947
ord7886
ord8038
ord7921
ord6852
ord4988
ord5254
ord2640
ord4254
ord3908
ord8685
ord8630
ord13828
ord8136
ord12661
ord14062
ord11444
ord11010
ord2581
ord3971
ord3903
ord7855
ord8691
ord8648
ord13983
ord10818
ord2976
ord11173
ord9357
ord8645
ord3874
ord4365
ord13925
ord3074
ord3073
ord3247
ord7618
ord2632
ord13881
ord5256
ord2496
ord3533
ord3909
ord3894
ord14095
ord12942
ord8255
ord3044
ord13932
ord4041
ord2075
ord11417
ord13912
ord12997
ord2699
ord2721
ord11286
ord12820
ord11824
ord3029
ord8727
ord8842
ord8790
ord4455
ord8753
ord8328
ord2344
ord2365
ord9442
ord8690
ord11403
ord12627
ord12508
ord2915
ord6724
ord7910
ord7933
ord12883
ord4862
ord13522
ord11672
ord3293
ord3329
ord13657
ord3090
ord5102
ord7255
ord2109
ord550
ord1169
ord622
ord1218
ord742
ord1280
ord767
ord1297
ord5549
ord8997
ord551
ord4268
ord8251
ord8161
ord13767
ord4232
ord7741
ord3122
ord10691
ord4244
ord3887
ord13137
ord4209
ord2010
ord4336
ord4294
ord8226
ord8387
ord8070
ord13733
ord4696
ord3143
ord2340
ord12030
ord14225
ord12087
ord14278
ord6505
ord12957
ord8468
ord11791
ord2212
ord14143
ord13865
ord777
ord4329
ord11375
ord2514
ord13652
ord13109
ord7048
ord7051
ord8224
ord7054
ord7049
ord7052
ord7053
ord7055
ord13626
ord7050
ord1298
ord8099
ord7472
ord11152
ord8908
ord4726
ord7647
ord8931
ord11865
ord3715
ord4874
ord12145
ord1766
ord13361
ord13359
ord11122
ord5743
ord8523
ord9045
ord11493
ord11488
ord3725
ord3185
ord7540
ord2049
ord10531
ord11182
ord2969
ord13965
ord11105
ord11199
ord1832
ord8896
ord9411
ord11193
ord2039
ord8124
ord12639
ord3232
ord3341
ord5540
ord9835
ord9838
ord9842
ord7393
ord984
ord1451
ord12923
ord7716
ord2273
ord2269
ord2178
ord4317
ord13545
ord8159
ord7673
ord7718
ord7739
ord13709
ord7416
ord7047
ord804
ord1844
ord365
ord1059
ord11709
ord11928
ord13864
ord2288
ord4446
ord450
ord1089
ord6250
ord1091
ord7235
ord3951
ord1893
ord6615
ord9941
ord5555
ord12606
ord11901
ord11933
ord10124
ord7920
ord11929
ord11921
ord5706
ord3731
ord6122
ord14289
ord6123
ord14290
ord6121
ord14288
ord7719
ord12212
ord14088
ord11665
ord11664
ord2011
ord7668
ord12625
ord3949
ord4011
ord9089
ord14216
ord7650
ord14210
ord12223
ord12222
ord2439
ord5183
ord8023
ord12544
ord8084
ord8167
ord8158
ord2725
ord12685
ord11582
ord13846
ord8665
ord8899
ord8176
ord13937
ord12264
ord6287
ord8901
ord8926

kernel32

GetLastError
InitializeCriticalSectionEx
OutputDebugStringW
LocalFree
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection

user32

LoadMenuW
GetSubMenu
SetRectEmpty
GetParent
SendMessageW
ScreenToClient
GetClientRect
InvalidateRect
UpdateWindow
GetWindowRect
InflateRect
GetSysColor
LoadBitmapW
EnableWindow
IsChild
GetFocus
IsIconic
LoadImageW
GetSystemMetrics
RedrawWindow
ClientToScreen

gdi32

CreateFontIndirectW
GetObjectW
DeleteObject
GetStockObject

comctl32

ImageList_AddMasked
InitCommonControlsEx

oleaut32

SysAllocString
VariantClear

vcruntime140

memset
__CxxFrameHandler3
__std_terminate
_purecall
_CxxThrowException
__C_specific_handler

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_exit
_get_wide_winmain_command_line
_initialize_wide_environment
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_configure_wide_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f2099b81825c117824f75918dd94946

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

comctl32

oleaut32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 58KB - Virtual size: 58KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 123KB - Virtual size: 123KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 58KB - Virtual size: 58KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 123KB - Virtual size: 123KB

.reloc
Size: 6KB - Virtual size: 5KB