xx1[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

xx1.exe
Size

1.3MB
MD5

7153dcf7d67d2b612072fc1e027663c3
SHA1

ae1e865cbd70d3d4c69087ab074ffb87898f4f61
SHA256

436ab377919038d7e080365c2ab42e0fe0a5536f77f72466308df088e4ac037e
SHA512

6cfc0c008ee0bf05794e7cc2f91701df15d284215f6842addcaf9f98d226a864a8a6955281af26e13666a1a718673ec154e743863b9c470908ae1b348a790e21
SSDEEP

12288:VpYxSDZj3boyzSfat5qywI+vcxOSPznoq7ppAnBUwoB1:VSxELoyzSfatTxOSP3B1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xx1.exe

Files

xx1.exe
.exe windows x64

fcc21243d987663b6c4c0bfa1d513cad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

EnterCriticalSection
RtlUnwindEx
GetACP
LocalFree
CloseHandle
SuspendThread
VirtualProtect
GetTickCount
QueryPerformanceFrequency
lstrcmpiA
VirtualFree
GetProcessHeap
HeapAlloc
GetStartupInfoW
ExitProcess
InitializeCriticalSection
GetCPInfoExW
GetThreadPriority
GetCurrentProcess
SetThreadPriority
VirtualAlloc
RtlUnwind
GetCPInfo
GetSystemInfo
GetCommandLineW
ResumeThread
GetProcAddress
LeaveCriticalSection
GetStdHandle
GetVersionExW
VerifyVersionInfoW
GetModuleHandleW
FreeLibrary
HeapCreate
HeapDestroy
LCMapStringW
GetDiskFreeSpaceW
VerSetConditionMask
GetUserDefaultUILanguage
FindFirstFileW
SetLastError
GetModuleFileNameW
GetLastError
GetNativeSystemInfo
lstrlenA
lstrlenW
CompareStringW
QueryPerformanceCounter
CreateThread
lstrcpyA
HeapFree
WideCharToMultiByte
MultiByteToWideChar
FindClose
LoadLibraryW
LoadLibraryA
ResetEvent
SetEvent
GetLocaleInfoW
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetLocalTime
WaitForSingleObject
GetCurrentThread
WriteFile
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
GetLogicalProcessorInformation
IsValidLocale
TlsSetValue
GetSystemDefaultUILanguage
LoadLibraryExW
EnumCalendarInfoW
LocalAlloc
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
CreateEventW
VirtualQueryEx
GetThreadLocale
SetThreadLocale
Sleep

ole32

CoInitialize
CoUninitialize

user32

GetMessageW
TranslateMessage
CharLowerBuffW
CharUpperW
PeekMessageW
GetSystemMetrics
MessageBoxA
MessageBoxW
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
GetCursorPos
DispatchMessageW

oleaut32

SysFreeString
VariantClear
VariantInit
GetErrorInfo
SysReAllocStringLen
SafeArrayCreate
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantChangeType

advapi32

CryptDeriveKey
CryptGetKeyParam
CryptSetKeyParam
CryptDecrypt
CryptDestroyKey
CryptImportKey
CryptDestroyHash
RegOpenKeyExW
CryptGetHashParam
CryptReleaseContext
RegQueryValueExW
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextW

Sections

.text
Size: 968KB - Virtual size: 968KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 49KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 568B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 109B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcc21243d987663b6c4c0bfa1d513cad

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

advapi32

Sections

.text Size: 968KB - Virtual size: 968KB

.data Size: 87KB - Virtual size: 87KB

.bss Size: - Virtual size: 49KB

.idata Size: 5KB - Virtual size: 4KB

.tls Size: - Virtual size: 568B

.rdata Size: 512B - Virtual size: 109B

.reloc Size: 61KB - Virtual size: 61KB

.pdata Size: 48KB - Virtual size: 47KB

.rsrc Size: 163KB - Virtual size: 163KB

.text
Size: 968KB - Virtual size: 968KB

.data
Size: 87KB - Virtual size: 87KB

.bss
Size: - Virtual size: 49KB

.idata
Size: 5KB - Virtual size: 4KB

.tls
Size: - Virtual size: 568B

.rdata
Size: 512B - Virtual size: 109B

.reloc
Size: 61KB - Virtual size: 61KB

.pdata
Size: 48KB - Virtual size: 47KB

.rsrc
Size: 163KB - Virtual size: 163KB