78bd260d[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

78bd260d.exe
Size

3.7MB
MD5

c05067dbe78d0c9625f420d1b3b03176
SHA1

8477c678ac86cb55a914d79cc28b304547079d0e
SHA256

c879b4f8bd38ddc5797d625effb573e7478dbc57efb3c99593c2a5a98d12b641
SHA512

65520f345fc0920fbf52ccac2ad2b6764c48b5d1d8e650565dbfffd1af734946f62d62c9f1f930bd4ec17e6822b578351bb08441bc3dc0a8c4e7af7b69aefcb6
SSDEEP

49152:GyjUxaxbgxB5PhmMVzmMGls+Z49yDM/cNwX+JiukbOAmPSgY:GuyaE5b0ucc+JrAJg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78bd260d.exe

Files

78bd260d.exe
.exe windows x64

c03be36e8e27ac7c4e63c8b17354eae1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

ws2_32

closesocket
WSASetLastError
send
recv
WSAGetLastError
WSACleanup

advapi32

ReportEventW
RegisterEventSourceW
DeregisterEventSource

kernel32

WriteConsoleW
GetModuleHandleA
TerminateProcess
CreateMutexA
GetCurrentDirectoryW
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThread
GetCurrentProcess
AcquireSRWLockExclusive
SetThreadStackGuarantee
AddVectoredExceptionHandler
ReleaseSRWLockShared
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
RtlVirtualUnwind
AcquireSRWLockShared
FreeLibrary
LoadLibraryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
HeapFree
HeapAlloc
GetProcessHeap
IsDebuggerPresent
ConvertFiberToThread
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
SystemTimeToFileTime
GetSystemTime
DeleteFiber
WideCharToMultiByte
FindNextFileW
FindFirstFileW
FindClose
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
FormatMessageW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
MultiByteToWideChar
GetProcAddress
GetModuleHandleW
WriteFile
GetFileType
GetStdHandle
WaitForSingleObject
CloseHandle
VirtualAlloc
VirtualFree
CreateThread
GetLastError
TryAcquireSRWLockExclusive

bcrypt

BCryptGenRandom

oleaut32

GetErrorInfo
SysFreeString
SysStringLen

ntdll

RtlNtStatusToDosError
NtWriteFile

vcruntime140

memchr
strchr
wcsstr
memmove
__current_exception
__current_exception_context
memcmp
memcpy
__CxxFrameHandler3
memset
strstr
_CxxThrowException
__C_specific_handler
strrchr

api-ms-win-crt-string-l1-1-0

strncpy
_stricmp
_strnicmp
strcspn
strspn
strcmp
isspace
strncmp
strlen

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
_set_new_mode

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
__p___argv
__p___argc
strerror_s
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initialize_onexit_table
_crt_atexit
signal
_errno
raise
_register_onexit_function
_c_exit
_exit

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsscanf
_wfopen
__stdio_common_vsprintf
fwrite
fclose
__p__commode
feof
ferror
fflush
fgets
_fileno
fread
fseek
ftell
_setmode
_set_fmode
fputs
__acrt_iob_func
fopen
__stdio_common_vswprintf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 605KB - Virtual size: 605KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c03be36e8e27ac7c4e63c8b17354eae1

Headers

DLL Characteristics

File Characteristics

Imports

user32

ws2_32

advapi32

kernel32

bcrypt

oleaut32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 605KB - Virtual size: 605KB

.data Size: 18KB - Virtual size: 32KB

.pdata Size: 70KB - Virtual size: 69KB

.reloc Size: 24KB - Virtual size: 23KB

.rsrc Size: 15KB - Virtual size: 16KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 605KB - Virtual size: 605KB

.data
Size: 18KB - Virtual size: 32KB

.pdata
Size: 70KB - Virtual size: 69KB

.reloc
Size: 24KB - Virtual size: 23KB

.rsrc
Size: 15KB - Virtual size: 16KB