1816f609045e9bdeabc08ee94ded8ba9123aa36c592bef7772c437436a88643c

Sharing

Copy URL Twitter E-mail

General

Target

1816f609045e9bdeabc08ee94ded8ba9123aa36c592bef7772c437436a88643c
Size

3.0MB
MD5

94d1bb33b8c22334e339d4462d4c0636
SHA1

c47f3f362b28b57c287891043984743f44eb80dd
SHA256

1816f609045e9bdeabc08ee94ded8ba9123aa36c592bef7772c437436a88643c
SHA512

877f28cd976275769d30f8b7e88da2ffd65949c0b7bf5ecc7cd219ada4e7746301a66617b2fcab785a893ba253e25502dc28d3462a47c41d30dbeb246561b9bc
SSDEEP

49152:L4XigPUFDotZnjagK7TB/bxTxZt9FAxp/R8A3a2V4nEsKpXc1b/r8NSMqmgEI/K/:j0MoHrYhoxp7BV4EXpXcWNSMZVnIY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1816f609045e9bdeabc08ee94ded8ba9123aa36c592bef7772c437436a88643c

Files

1816f609045e9bdeabc08ee94ded8ba9123aa36c592bef7772c437436a88643c
.exe windows x64

4a8089c2c09cfd483e4279c6abfb675e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetFileCompletionNotificationModes
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

oleaut32

SafeArrayUnaccessData

crypt32

CertVerifyCertificateChainPolicy

user32

SetClipboardData

advapi32

RegQueryValueExW

bcrypt

BCryptOpenAlgorithmProvider

ws2_32

getaddrinfo

ntdll

NtCreateFile

secur32

EncryptMessage

gdi32

DeleteDC

ole32

CoSetProxyBlanket

vcruntime140

__current_exception_context

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

_dclass

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

dsdfsdfw
Size: - Virtual size: 935KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

dsdfsdfw
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dsdfsdfw
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a8089c2c09cfd483e4279c6abfb675e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

crypt32

user32

advapi32

bcrypt

ws2_32

ntdll

secur32

gdi32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 2.7MB

.rdata Size: - Virtual size: 1.1MB

.data Size: - Virtual size: 27KB

.pdata Size: - Virtual size: 64KB

dsdfsdfw Size: - Virtual size: 935KB

dsdfsdfw Size: 4KB - Virtual size: 4KB

dsdfsdfw Size: 3.0MB - Virtual size: 3.0MB

.text
Size: - Virtual size: 2.7MB

.rdata
Size: - Virtual size: 1.1MB

.data
Size: - Virtual size: 27KB

.pdata
Size: - Virtual size: 64KB

dsdfsdfw
Size: - Virtual size: 935KB

dsdfsdfw
Size: 4KB - Virtual size: 4KB

dsdfsdfw
Size: 3.0MB - Virtual size: 3.0MB