notifu64[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

notifu64.exe
Size

289KB
MD5

22ccbd8cb9e0aeecd800982b775f6c53
SHA1

435ef53a9ae4ca0ec440b7eaa30ca88c63944a9d
SHA256

782844f162bdd974197f2fcba5f0ddc19b68b03452724deade3b9e8581a707a2
SHA512

2152f44fa154820a5b7e4ee6035d77629a40fcd5b132c2272b3da0b2ff4e77b4384a048b4513b1cf4bdd3f6d9c3789f5bf73d04b6b2bdadad7b1ff1534cdb575
SSDEEP

6144:qyXuL7nGyV8EmwzLkFp7BQIoo5tTMH8PiBH0QcPskEbQ:qyXajGgkFp7Bgo5isPsk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
notifu64.exe

Files

notifu64.exe
.exe windows x64

2223b1fe471c042d680cf39603593353

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetModuleFileNameExW

kernel32

GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetProcAddress
OpenProcess
GetCurrentProcessId
GetProcessId
GetCurrentProcess
GetTickCount
CreateSemaphoreW
CreateEventW
SetEvent
GetFileAttributesW
SignalObjectAndWait
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
RaiseException
GetLastError
DecodePointer
DeleteCriticalSection
OutputDebugStringW
WriteConsoleW
SetStdHandle
LoadLibraryExW
SetFilePointerEx
ReadFile
GetACP
MultiByteToWideChar
GetModuleHandleW
ReadConsoleW
ReleaseSemaphore
EnterCriticalSection
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
WriteFile
GetFileType
GetStdHandle
IsDebuggerPresent
LeaveCriticalSection
WideCharToMultiByte
GetStringTypeW
EncodePointer
HeapFree
IsProcessorFeaturePresent
GetCommandLineW
HeapAlloc
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
HeapSize
IsValidCodePage
GetOEMCP

user32

GetSystemMetrics
LoadIconW
MessageBoxW
DestroyIcon
wsprintfW
LoadImageW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
RegCloseKey

shell32

SHGetFileInfoW
ExtractIconExW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2223b1fe471c042d680cf39603593353

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

advapi32

shell32

ole32

version

Sections

.text Size: 187KB - Virtual size: 187KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 10KB - Virtual size: 22KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 187KB - Virtual size: 187KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 10KB - Virtual size: 22KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 3KB