eaafd7f635277e50c3f98c53c0bf7fe19c2a798228dc59007e0a6c0c47f0ab35

Sharing

Copy URL Twitter E-mail

General

Target

eaafd7f635277e50c3f98c53c0bf7fe19c2a798228dc59007e0a6c0c47f0ab35
Size

46KB
MD5

35a4082840aba592bd3dabc587b4d85d
SHA1

81e7548ef72277308b41c018c166eef0d0ca832b
SHA256

eaafd7f635277e50c3f98c53c0bf7fe19c2a798228dc59007e0a6c0c47f0ab35
SHA512

5bedd9809dbd92b6d24baa99157ad6dafccb9a2a77a1ada115f0e77ad9a0e5b364a8eee65732b7766d1a0866141e241a218a45a4d6540996784edd771ddf1779
SSDEEP

768:S7QTNEVbo8MiFVF7hMGLzSiMMv3udEGd:S7IEVk8MiFVvMVMmm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eaafd7f635277e50c3f98c53c0bf7fe19c2a798228dc59007e0a6c0c47f0ab35

Files

eaafd7f635277e50c3f98c53c0bf7fe19c2a798228dc59007e0a6c0c47f0ab35
.exe windows x64

39aa147c6e22188a711b0ee55066c3bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualProtect
VirtualFree
VirtualAlloc
WaitForSingleObject
CreateEventW
Sleep
SetEvent
GetCurrentThread
CloseHandle
CreateThread
ResetEvent
AddVectoredExceptionHandler
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
SetLastError
VirtualQueryEx
VirtualProtectEx
VirtualQuery
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetCurrentProcess
GetLastError

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
__current_exception_context
__C_specific_handler
memcpy
__current_exception
memset

api-ms-win-crt-stdio-l1-1-0

fseek
rewind
fread
ftell
fclose
fopen
_set_fmode
__p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
free
malloc
calloc

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
terminate
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
exit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
_crt_atexit
__p___argc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39aa147c6e22188a711b0ee55066c3bd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.detourc Size: 8KB - Virtual size: 8KB

.detourd Size: 512B - Virtual size: 24B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.detourc
Size: 8KB - Virtual size: 8KB

.detourd
Size: 512B - Virtual size: 24B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB