20a308e65c20ff7de1f2a1cd047464b5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

20a308e65c20ff7de1f2a1cd047464b5.exe
Size

2.3MB
MD5

20a308e65c20ff7de1f2a1cd047464b5
SHA1

107b781759d3d51cb1f634d53bc478db5c5a828c
SHA256

ad91669c04a71d1adedd3800fcfb505734e442a891a532e1ad18c54b05acc98d
SHA512

ccf9d81d1783ba589ab2d12ada154bf13cd396a515c95737903d4a87d7c881c54a94226cde61714bdcc96f0eb62e2c4b7d1a8da2e6f9b657fa276a474a5f854e
SSDEEP

49152:zJWNjg2jZws6aBeNio8njOpQ7EsIU6iHWm2lOZjS:zajgKZwieH8aqW+V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20a308e65c20ff7de1f2a1cd047464b5.exe

Files

20a308e65c20ff7de1f2a1cd047464b5.exe
.exe windows x86

178ccf246b8347cf38428a657085a6d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
GetProcAddress
GetCommandLineW
GetModuleFileNameW
CreateFileW
GetFullPathNameW
GetFinalPathNameByHandleW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
GetModuleHandleA
FindClose
GetFileInformationByHandle
GetQueuedCompletionStatusEx
GetFileType
SetFileCompletionNotificationModes
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteFileW
SetFileInformationByHandle
DuplicateHandle
SleepConditionVariableSRW
WakeAllConditionVariable
PostQueuedCompletionStatus
WakeConditionVariable
AcquireSRWLockExclusive
SwitchToThread
GetCurrentThreadId
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
CreateThread
GetCurrentProcessId
SetHandleInformation
GetCurrentThread
GetSystemInfo
FindFirstFileW
SetThreadStackGuarantee
AddVectoredExceptionHandler
CreateIoCompletionPort
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStdHandle
ReleaseSRWLockExclusive
SystemTimeToFileTime
TlsSetValue
TlsGetValue
SetConsoleTextAttribute
ExitProcess
GetConsoleScreenBufferInfo
SetConsoleMode
GetConsoleMode
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
MoveFileExW
CopyFileExW
CloseHandle
TryAcquireSRWLockExclusive
GetLastError
FormatMessageW
GetFileInformationByHandleEx
TerminateProcess

ws2_32

recv
getsockname
WSACleanup
WSAStartup
freeaddrinfo
WSASend
shutdown
WSASocketW
send
WSAIoctl
setsockopt
accept
closesocket
WSAGetLastError
ioctlsocket
listen
bind
getaddrinfo

iphlpapi

GetAdaptersAddresses

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile
NtCreateFile
NtReadFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

memmove
memcpy
_except_handler4_common
memcmp
memset
_CxxThrowException
__CxxFrameHandler3
__current_exception
__current_exception_context

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

exit
_exit
__p___argc
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_set_app_type
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
_crt_atexit
_controlfp_s
terminate
_initterm_e
__p___argv
_seh_filter_exe
_cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 761KB - Virtual size: 760KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

178ccf246b8347cf38428a657085a6d6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

iphlpapi

ntdll

bcrypt

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 761KB - Virtual size: 760KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 65KB - Virtual size: 64KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 761KB - Virtual size: 760KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 65KB - Virtual size: 64KB