EoAExperiences[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

EoAExperiences.exe
Size

148KB
MD5

1d0a840d731a2c1f2e1fb5b8596b4c34
SHA1

b705893b07e5ab5e14cb55dc071124d4cd178cf3
SHA256

6a4b62741c5959327964dc426691891fe85d8197b08db5bba2aa23732cf0d0bf
SHA512

67f6ca671a1644bd3ff11adc379546a519958406c56846dc12d80c3341ee33ab6ddd5387ff166116bbb72e0b25b94b86d360f02d226ad3470eb92d57b508fd79
SSDEEP

3072:rZNjFu8ehbLPVcZJvbTDGv7t0n/EhcyjKZ8+:r3jU8icLv6T66KC+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EoAExperiences.exe

Files

EoAExperiences.exe
.exe windows x64

d46678b9b998f5730b05d75e27442fe5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__ltow_s
_o__purecall
_o__register_onexit_function
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o_exit
_o_free
_o_malloc
_o_terminate
_o_wcstok
__C_specific_handler
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__CxxFrameHandler4
__std_terminate
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
_o__seh_filter_exe

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-downlevel-kernel32-l1-1-0

ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW
CreateMutexW
CompareStringEx
ProcessIdToSessionId
InitOnceBeginInitialize
InitOnceComplete
CreateThreadpoolTimer
WaitForSingleObject
GetModuleHandleExW
DebugBreak
CreateEventExW
CreateThreadpoolWait
FreeLibrary
GetCurrentProcess
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
CreateSemaphoreExW
InitializeCriticalSectionEx
SetLastError
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
DeleteCriticalSection
EnterCriticalSection
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
MultiByteToWideChar
InterlockedPushEntrySList
SetThreadpoolTimer
ReleaseSRWLockShared
AcquireSRWLockShared
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
IsProcessorFeaturePresent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleHandleW
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseHandle
OutputDebugStringW
GetLastError
FormatMessageW
LeaveCriticalSection

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ

api-ms-win-core-com-l1-1-0

CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc

ext-ms-win-rtcore-ntuser-window-ext-l1-1-0

GetMessageW
RegisterClassExW
PostMessageW
FindWindowW
DispatchMessageW
CreateWindowExW
TranslateMessage
SetWindowPos
SetTimer
KillTimer
DestroyWindow
DefWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegNotifyChangeKeyValue
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

ext-ms-win-uiacore-l1-1-1

UiaGetReservedMixedAttributeValue

oleaut32

VariantInit
VariantClear
SysStringLen
SysFreeString
SafeArrayDestroy

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW

d2d1

ord1

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-windowserrorreporting-l1-1-3

RegisterApplicationRestart

ntdll

RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsPreallocateStringBuffer
WindowsCreateStringReference
WindowsCreateString
WindowsDeleteStringBuffer
WindowsPromoteStringBuffer

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d46678b9b998f5730b05d75e27442fe5

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-downlevel-kernel32-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

msvcp_win

api-ms-win-core-com-l1-1-0

ext-ms-win-rtcore-ntuser-window-ext-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

ext-ms-win-uiacore-l1-1-1

oleaut32

api-ms-win-ntuser-sysparams-l1-1-0

d2d1

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-3

ntdll

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

Sections

.text Size: 105KB - Virtual size: 105KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 1024B - Virtual size: 524B

.text
Size: 105KB - Virtual size: 105KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 1024B - Virtual size: 524B