f66b1fc1dc2c9c700d810a9fccb46524[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f66b1fc1dc2c9c700d810a9fccb46524.exe
Size

629KB
MD5

f66b1fc1dc2c9c700d810a9fccb46524
SHA1

07e79647121e1be4af4bb7e20ff9109457011405
SHA256

59eca81a631d418a5a013cf13475510c7c8bb8070e9799941e607877e37e4580
SHA512

b7416f93fe1113841a38dd6c20c089af69b54722dabaa0b4ff58549e5e9707b065a6f5014408e5c00f780f8d73f34cb71b19a5e60786c0522f10198c1ff1a757
SSDEEP

12288:5LkMP0iPkVFLqlPiCZ3XWNMA6HhtXWAORvbHZI:lkHRqlPiCZ3gMBHhZk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f66b1fc1dc2c9c700d810a9fccb46524.exe

Files

f66b1fc1dc2c9c700d810a9fccb46524.exe
.exe windows x64

c4e9ea639702b9542c3ea62d13e7f13d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
GetProcessHeap
HeapAlloc
ReleaseSRWLockExclusive
CompareStringW
SwitchToThread
GetStringTypeW
GetFileType
SetStdHandle
WaitForSingleObject
AcquireSRWLockExclusive
SetEnvironmentVariableW
FreeEnvironmentStringsW
SetThreadStackGuarantee
WakeAllConditionVariable
SleepConditionVariableSRW
WakeConditionVariable
GetSystemInfo
AddVectoredExceptionHandler
SwitchToFiber
CreateFiber
ConvertThreadToFiber
GetModuleHandleA
GetProcAddress
TryEnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
WriteFile
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
SetLastError
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetCommandLineW
VirtualProtect
GetFullPathNameW
CreateFileW
InitializeCriticalSection
EnterCriticalSection
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
SetHandleInformation
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
GetCurrentThread
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
CreateThread
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetDiskFreeSpaceExW
GetProcessTimes
FindClose
LocalFree
GetProcessIoCounters
OpenProcess
ReadProcessMemory
GetCommandLineA
GetModuleHandleExW
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount64
GetLastError
GlobalMemoryStatusEx
ExitProcess
RtlPcToFileHeader
MoveFileExW
SetFilePointerEx
GetUserDefaultLCID
LoadLibraryExW
GetLogicalDrives
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RaiseException
EncodePointer
RtlUnwindEx
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcessId
IsDebuggerPresent
RtlVirtualUnwind
CloseHandle
InitializeSListHead
GetCurrentThreadId
HeapFree
GetModuleFileNameW
HeapReAlloc

pdh

PdhOpenQueryA
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhLookupPerfNameByIndexW
PdhAddCounterW
PdhCollectQueryData

shell32

ShellExecuteW
CommandLineToArgvW

snmpapi

SnmpUtilMemAlloc

crypt32

CertGetCertificateChain
CertDuplicateStore
CertCloseStore
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertFreeCertificateContext
CertOpenStore
CertFreeCertificateChain

secur32

EncryptMessage
AcquireCredentialsHandleA
DecryptMessage
FreeCredentialsHandle
FreeContextBuffer
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextW
QueryContextAttributesW

ws2_32

WSAGetLastError
getaddrinfo
connect
ioctlsocket
WSAStartup
freeaddrinfo
WSACleanup
WSASocketW
getsockopt
setsockopt
getpeername
send
closesocket
recv
select
getsockname

advapi32

RegQueryValueExA
SystemFunction036

bcrypt

BCryptGenRandom

ntdll

RtlGetVersion
NtQuerySystemInformation
NtQueryInformationProcess

ole32

CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket

powrprof

CallNtPowerInformation

iphlpapi

FreeMibTable
GetIfEntry2
GetIfTable2

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetQueryDisplayInformation

oleaut32

VariantClear
SysAllocString
SysFreeString

psapi

EnumProcessModulesEx
GetModuleFileNameExW

Sections

.text
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4e9ea639702b9542c3ea62d13e7f13d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pdh

shell32

snmpapi

crypt32

secur32

ws2_32

advapi32

bcrypt

ntdll

ole32

powrprof

iphlpapi

netapi32

oleaut32

psapi

Sections

.text Size: 396KB - Virtual size: 395KB

.rdata Size: 143KB - Virtual size: 142KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 14KB - Virtual size: 14KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 396KB - Virtual size: 395KB

.rdata
Size: 143KB - Virtual size: 142KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 14KB - Virtual size: 14KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 4KB - Virtual size: 4KB