f_00010d | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

f_00010d
Size

260KB
MD5

b940c48090d0e6cc3c87ebbcfbd61749
SHA1

718337f94bfe9a434ec02b86c9a8ac1dc0a144c9
SHA256

6a745fb7e52ce911e2992d3a4aaaedd4b58195d3134dd14fc7402b26ecc5ae12
SHA512

9f5ea2eae9e6276a1bcdbd2d393b4408173ee14671696e19cf600ce1ad7e05056a0203f385461161b1a972425ed2d5e22066ccbef9ec71feaa29f194579a67f0
SSDEEP

6144:zthCubItulOyBIzCrXyqIxAwt5pfYNoNo:ziNuXSz8DIC0fDN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f_00010d

Files

f_00010d
.exe windows x64

fb00e0661d92d811f7c262b629a61616

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualLock
DeleteFileW
GetModuleHandleW
GetCommandLineW
VirtualUnlock
GetCurrentProcessId
GetFirmwareEnvironmentVariableW
SetLastError
CloseHandle
CreateFileW
DeviceIoControl
Sleep
VirtualAlloc
VirtualFree
GetSystemInfo
GetLastError
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
ReadConsoleW
ReadFile
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
GetFileType
LCMapStringW
CompareStringW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
HeapFree
HeapAlloc
RaiseException

advapi32

RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegSetKeyValueW
RegCloseKey
RegOpenKeyW
RegDeleteKeyW

ntdll

LdrAccessResource
NtLoadDriver
RtlSetLastWin32Error
NtCreateFile
RtlInitString
RtlFreeHeap
NtQueryDirectoryObject
RtlExpandEnvironmentStrings
NtOpenDirectoryObject
NtFlushBuffersFile
LdrFindResource_U
RtlFreeUnicodeString
NtUnloadDriver
NtWriteFile
NtQuerySystemInformation
RtlAllocateHeap
LdrGetProcedureAddress
NtOpenProcessToken
NtAdjustPrivilegesToken
RtlDoesFileExists_U
RtlGetVersion
RtlNtStatusToDosError
NtDeviceIoControlFile
NtClose
RtlImageNtHeader
LdrLoadDll
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U

msdelta

DeltaFree
ApplyDeltaB

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb00e0661d92d811f7c262b629a61616

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ntdll

msdelta

Sections

.text Size: 108KB - Virtual size: 108KB

.rdata Size: 45KB - Virtual size: 44KB

.data Size: 17KB - Virtual size: 21KB

.pdata Size: 6KB - Virtual size: 5KB

.gfids Size: 512B - Virtual size: 164B

.rsrc Size: 80KB - Virtual size: 79KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 108KB - Virtual size: 108KB

.rdata
Size: 45KB - Virtual size: 44KB

.data
Size: 17KB - Virtual size: 21KB

.pdata
Size: 6KB - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 164B

.rsrc
Size: 80KB - Virtual size: 79KB

.reloc
Size: 2KB - Virtual size: 1KB