3dd8866122dffc4fe2a403ba7b5a9c6a8e6a7ea413d8e9a26bacac9e71f4e3fe

Sharing

Copy URL Twitter E-mail

General

Target

3dd8866122dffc4fe2a403ba7b5a9c6a8e6a7ea413d8e9a26bacac9e71f4e3fe
Size

1.9MB
MD5

5a6e8141aebd29752d2a023118546c4e
SHA1

e997bd9a620364a50e5c22ad4387178f30712560
SHA256

3dd8866122dffc4fe2a403ba7b5a9c6a8e6a7ea413d8e9a26bacac9e71f4e3fe
SHA512

bdf11c8c2225ea3a07786eed909c995e17ad3115aebe2fef1f369b8fbe7f76fbe55a08c1a57008f256571b00bf4cfd9f0fafc52dfe9b124522cf5bd1b56c4949
SSDEEP

49152:NVmleVvo22xCzAeYGkgr1WEUbnan1cjIU6idF:CYeteQni+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dd8866122dffc4fe2a403ba7b5a9c6a8e6a7ea413d8e9a26bacac9e71f4e3fe

Files

3dd8866122dffc4fe2a403ba7b5a9c6a8e6a7ea413d8e9a26bacac9e71f4e3fe
.exe windows x64

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions

kernel32

FindClose
SetThreadErrorMode
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
CompareStringOrdinal
GetProcessId
GetComputerNameExW
GetCurrentProcessId
CreateFileW
LocalAlloc
OpenProcess
SetCurrentDirectoryW
MoveFileExW
Sleep
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
CreateRemoteThreadEx
RemoveDirectoryW
DeleteFileW
CopyFileExW
LoadLibraryExW
FreeLibrary
GetProcAddress
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
WakeAllConditionVariable
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
VirtualQueryEx
GetSystemInfo
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ConnectNamedPipe
ReadFile
WriteFile
CancelIoEx
CreateNamedPipeW
GetModuleHandleA
ReleaseSRWLockExclusive
WakeConditionVariable
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
GetCurrentProcess
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlCaptureContext
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
WriteFileEx
CreateEventW
CancelIo
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
CreateIoCompletionPort
RtlVirtualUnwind
GetCurrentThreadId
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
SetUnhandledExceptionFilter
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
FindFirstFileW
SwitchToThread
GetExitCodeProcess
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
GetLastError
ReadFileEx
SleepEx
CloseHandle
InitializeSListHead
IsDebuggerPresent
SleepConditionVariableSRW
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
GetStringTypeW
RtlPcToFileHeader
RaiseException
GetFileType
SetStdHandle
SetEnvironmentVariableW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
IsValidCodePage
FindFirstFileExW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
TlsFree
UnhandledExceptionFilter

ntdll

NtReadFile
NtQuerySystemInformation
NtQueryInformationProcess
RtlGetVersion
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile

iphlpapi

GetExtendedUdpTable
FreeMibTable
GetIfTable2
GetExtendedTcpTable

advapi32

FreeSid
SetEntriesInAclW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetUserNameW

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear

pdh

PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExA
GetModuleFileNameExW
GetPerformanceInfo

shell32

CommandLineToArgvW

ws2_32

WSAGetLastError
closesocket
connect
getsockname
setsockopt
ioctlsocket
send
WSASend
recv
WSASocketW
WSACleanup
WSAStartup
getaddrinfo
freeaddrinfo
getsockopt
select
bind

d3d11

D3D11CreateDevice

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory1

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 635KB - Virtual size: 634KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

ntdll

iphlpapi

advapi32

netapi32

ole32

oleaut32

pdh

powrprof

psapi

shell32

ws2_32

d3d11

bcrypt

dxgi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 635KB - Virtual size: 634KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 64KB - Virtual size: 63KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 635KB - Virtual size: 634KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 64KB - Virtual size: 63KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 9KB - Virtual size: 8KB