b9d6c29ba190a9bff6f11728fe80adea[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b9d6c29ba190a9bff6f11728fe80adea.exe
Size

634KB
MD5

b9d6c29ba190a9bff6f11728fe80adea
SHA1

3c3ec7917ad7c4286083e21dcb77b0034c94cc7e
SHA256

05699ec51985fd8b24daac09abbfa873c129b98b857e040e276022797c24a8ea
SHA512

4b6935be226e2c3f8c67fe7850d64205e526a2f2f1788d1135b56d900edae8310e6b1985db7c4b7d58c05647716d052d8c080bf4eaf254e6a090f3bd9d7cc3d5
SSDEEP

12288:Tee9CNmn1yjnivHTJBxPTXzGwDJcqMuGEPnW:qe9imn1+uJBxPTjGwSqMupnW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9d6c29ba190a9bff6f11728fe80adea.exe

Files

b9d6c29ba190a9bff6f11728fe80adea.exe
.exe windows x64

e45ee5a5caca285ab90d6f0ce6312ed0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetUserNameW
RegQueryValueExW
CryptReleaseContext
OpenProcessToken
GetTokenInformation
GetLengthSid
EventActivityIdControl
CreateWellKnownSid
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
EventUnregister
EventRegister
EventWrite
RegDeleteKeyValueW
RegEnumKeyW
CryptDestroyHash
CryptDestroyKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptSetKeyParam
CryptEncrypt
CryptDecrypt
CryptGenRandom
CryptGetHashParam
CryptGetUserKey
CryptImportKey
CryptGenKey
CryptExportKey
RegGetValueW

kernel32

CreateFileW
GetFileSizeEx
ReadFile
FormatMessageW
FindFirstFileW
FindClose
GetTickCount
Sleep
MoveFileExW
DeleteFileW
WaitForMultipleObjects
GetComputerNameW
WideCharToMultiByte
ExpandEnvironmentStringsW
lstrlenA
GlobalFree
LoadLibraryExW
SizeofResource
MultiByteToWideChar
lstrcmpiW
GetProcAddress
GetCommandLineW
lstrcmpW
MulDiv
GlobalLock
GlobalHandle
SetLastError
LocalAlloc
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
ResetEvent
QueueUserWorkItem
RegisterApplicationRestart
RaiseException
GlobalUnlock
FlushInstructionCache
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
GetFullPathNameW
LocalFree
CompareStringW
GetModuleFileNameW
FreeLibrary
SetWaitableTimer
CreateWaitableTimerW
LoadLibraryW
HeapFree
ReleaseMutex
lstrlenW
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetModuleHandleW
GetProcessHeap
HeapAlloc
WriteFile
GetFileSize
GetSystemTime
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
OutputDebugStringW
DeleteTimerQueueEx
CreateSemaphoreW
ReleaseSemaphore
OpenMutexW
GetTempPathW
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedPushEntrySList
VirtualAlloc
InterlockedPopEntrySList
VirtualFree
GetVersionExA
FindResourceW
CloseHandle
SetEvent
WaitForSingleObject
CreateThread
CreateMutexW
GetLastError
CreateEventW
CreateDirectoryW
LoadResource
LockResource
HeapSetInformation
GlobalAlloc

gdi32

BitBlt
CreateFontIndirectW
SetBkColor
SetTextColor
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps

user32

CloseClipboard
GetCaretPos
LoadMenuW
GetSubMenu
TrackPopupMenu
SetClipboardData
EmptyClipboard
OpenClipboard
GetWindowRect
UnregisterHotKey
RegisterHotKey
SystemParametersInfoW
FrameRect
GetSystemMetrics
DialogBoxIndirectParamW
PostQuitMessage
OpenIcon
DestroyMenu
GetDialogBaseUnits
MessageBeep
AllowSetForegroundWindow
FlashWindowEx
IsIconic
GetSysColorBrush
GetDCEx
SetCursor
PtInRect
IsWindowEnabled
LoadImageW
GetWindowInfo
GetActiveWindow
SetDlgItemTextW
SetWindowContextHelpId
SetTimer
EndDialog
PostMessageW
SetForegroundWindow
SendDlgItemMessageW
UpdateWindow
EnableWindow
CharUpperW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
IsWindow
GetClassNameW
GetSysColor
CharNextW
SetWindowPos
DestroyAcceleratorTable
RedrawWindow
GetClassInfoExW
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
InvalidateRect
InvalidateRgn
CallWindowProcW
GetDC
ReleaseDC
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
GetWindowLongW
SetWindowLongW
DefWindowProcW
LoadCursorW
RegisterClassExW
CreateDialogIndirectParamW
IsDialogMessageW
MapDialogRect
MapWindowPoints
UnregisterClassA
KillTimer
TranslateAcceleratorW
GetMessageW
CopyAcceleratorTableW
LoadAcceleratorsW
LoadIconW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
CreateWindowExW
ShowWindow
SendMessageW
GetDlgItem
LoadStringW
DrawFocusRect

msvcrt

memcpy
srand
time
_purecall
swscanf_s
_errno
realloc
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_wtol
iswdigit
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
_itow
towupper
wcstok
wcsncmp
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
_callnewh
_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
__C_specific_handler
memset
_wtoi
_vsnprintf
_time64
wcsncpy_s
malloc
swprintf_s
free
calloc
memcpy_s
_vsnwprintf
memmove_s
memcmp

ws2_32

WSAStartup
WSAGetLastError
socket
connect
closesocket
WSACleanup
WSAIoctl
WSASocketW
FreeAddrInfoW
GetAddrInfoW

ntdll

WinSqmAddToStream
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv4AddressToStringW
NtQueryInformationToken
NtOpenProcessToken
NtClose
NtOpenThreadToken

secur32

GetUserNameExW

ole32

OleInitialize
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
GetHGlobalFromStream
CreateBindCtx
CoCreateInstanceEx
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
OleUninitialize
CoUninitialize
CoInitialize
CoCreateInstance
CoGetObject
CoCreateGuid
CoInitializeEx
StringFromIID

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SysReAllocString
SafeArrayCreateVector
VarBstrCat
SysStringByteLen
DispCallFunc
SafeArrayDestroy
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarBstrCmp
SysAllocStringLen
SysStringLen
VariantClear
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit

shlwapi

PathFindExtensionW
PathFindFileNameW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

comctl32

PropertySheetW
CreatePropertySheetPageW
ord345
ord413
ImageList_LoadImageW
ord410
ord344
InitCommonControlsEx

shell32

ord258
SHGetSpecialFolderPathW
ShellExecuteW
ord261
CommandLineToArgvW

urlmon

MkParseDisplayNameEx

uxtheme

CloseThemeData
GetThemeColor
IsAppThemed
GetThemeFont
OpenThemeData

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

ndfapi

NdfCreateIncident
NdfExecuteDiagnosis
NdfCloseIncident

rpcrt4

RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcStringFreeW
I_RpcExceptionFilter
RpcBindingFromStringBindingW
NdrClientCall3

Sections

.text
Size: 403KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 208KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e45ee5a5caca285ab90d6f0ce6312ed0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ws2_32

ntdll

secur32

ole32

oleaut32

shlwapi

comdlg32

comctl32

shell32

urlmon

uxtheme

crypt32

ndfapi

rpcrt4

Sections

.text Size: 403KB - Virtual size: 403KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 208KB - Virtual size: 212KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 403KB - Virtual size: 403KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 208KB - Virtual size: 212KB

.reloc
Size: 3KB - Virtual size: 2KB