9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453

Resubmissions

30-07-2023 06:59

230730-hsjknsgd78 10

30-07-2023 06:57

230730-hrd9kagd75 10

28-07-2023 15:26

230728-svbyqadh66 10

Sharing

Copy URL

Twitter E-mail

General

Target

9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453
Size

320KB
MD5

cb7786ac2d9c0b586ccbe12b3bc32693
SHA1

4d40f8743c194671a96211ee6b4c751a4bf50871
SHA256

9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453
SHA512

cee77848b9bed772e32aca5009ebde34bf1ef1ad62197630a20d9c9de3905e09881a9dc639bd56bc44f499815ed92cbc93d254423793f7bec58a4ff2e42a593e
SSDEEP

6144:Vk1F9vhVI8vzPW2t1BOGu1CuDq1hzF0r2Z:VeF9jI8vzPnt7YCF0SZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453

Files

9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453
.exe windows x64

f31a9f928e8949ae2a61570b14dcc19f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CancelIo
CloseHandle
CreateEventA
CreateFileW
CreateIoCompletionPort
CreateMutexA
CreateProcessW
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteTimerQueue
EncodePointer
EnterCriticalSection
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileAttributesW
GetFileSizeEx
GetFileType
GetLastError
GetLocalTime
GetLogicalDriveStringsW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultUILanguage
GetSystemTimeAsFileTime
GetUserDefaultUILanguage
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MoveFileW
MultiByteToWideChar
OpenProcess
PostQueuedCompletionStatus
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessShutdownParameters
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
WriteConsoleW
WriteFile
lstrcatW
lstrcmpW
lstrcmpiW
lstrcpyW
lstrlenW

user32

wsprintfA
wsprintfW
wvsprintfW

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize

oleaut32

SysAllocString
VariantClear
VariantInit

advapi32

CryptAcquireContextA
CryptGenRandom

shell32

CommandLineToArgvW
SHEmptyRecycleBinA

shlwapi

StrStrIA
StrStrIW

rstrtmgr

RmEndSession
RmGetList
RmRegisterResources
RmShutdown
RmStartSession

ws2_32

WSAAddressToStringW
WSACleanup
WSAGetLastError
WSAIoctl
WSASocketW
WSAStartup
bind
closesocket
gethostbyname
gethostname
getsockopt
htons
inet_ntoa
setsockopt
shutdown
socket

netapi32

NetApiBufferFree
NetShareEnum

iphlpapi

GetIpNetTable

Sections

.text
Size: 255KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.voltbl
Size: 512B - Virtual size: 46B

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.O@_
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 411B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

f31a9f928e8949ae2a61570b14dcc19f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

advapi32

shell32

shlwapi

rstrtmgr

ws2_32

netapi32

iphlpapi

Sections

.text Size: 255KB - Virtual size: 254KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 12KB

.pdata Size: 5KB - Virtual size: 5KB

.00cfg Size: 512B - Virtual size: 40B

.voltbl Size: 512B - Virtual size: 46B

_RDATA Size: 512B - Virtual size: 244B

.O@_ Size: 6KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 411B

.text
Size: 255KB - Virtual size: 254KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 12KB

.pdata
Size: 5KB - Virtual size: 5KB

.00cfg
Size: 512B - Virtual size: 40B

.voltbl
Size: 512B - Virtual size: 46B

_RDATA
Size: 512B - Virtual size: 244B

.O@_
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 411B