26cc2c0b3d24379edcf122dd96204bbad4ef400fd8042928e4a99f1c7d260149

Sharing

Copy URL

Twitter E-mail

General

Target

26cc2c0b3d24379edcf122dd96204bbad4ef400fd8042928e4a99f1c7d260149
Size

5.6MB
MD5

8b7f806bcca50dc2812ff7e42200d14c
SHA1

64cfc37476b51bad27459ae0f65a5fd6dc2413b4
SHA256

26cc2c0b3d24379edcf122dd96204bbad4ef400fd8042928e4a99f1c7d260149
SHA512

2470048c646ff55844c44d7065314e6e51542f69017eef5c7c55f5ef7b602b829eb7fc52aee91250469d7bde366b4b2eace203d973d192660f2276fe16616d27
SSDEEP

98304:jm+lYSVgCytBkXrq6rdEDRf+Ervp7TIlBII0+p8jCYP7+DIOHb3V:qoYSVgCytBkXrq6rdEDRWErvp7sleJ+P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26cc2c0b3d24379edcf122dd96204bbad4ef400fd8042928e4a99f1c7d260149

Files

26cc2c0b3d24379edcf122dd96204bbad4ef400fd8042928e4a99f1c7d260149
.exe windows x64

fb0355cb85545dabc29b1e9b1344a319

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

getpeername
bind
closesocket
shutdown
listen
getsockname
ntohs
getsockopt
htons
setsockopt
WSAGetLastError
WSACleanup
gethostbyname
gethostname
sendto
inet_ntoa
select
WSAStartup
htonl
ioctlsocket
inet_addr
gethostbyaddr
getservbyport
getservbyname
WSASetLastError
recv
send
accept
connect
socket
__WSAFDIsSet
recvfrom

ws2_32

WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSACloseEvent
WSAIoctl
WSASend
WSASocketW
getaddrinfo
WSAAddressToStringA
WSARecv
freeaddrinfo

iphlpapi

GetTcpTable2

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertAddEncodedCertificateToStore
CertDeleteCertificateFromStore
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetNameStringA
CertOpenSystemStoreW

kernel32

GetFileAttributesExW
DeleteFileW
HeapReAlloc
CloseHandle
HeapAlloc
GetCurrentDirectoryW
UnlockFile
SetCurrentDirectoryW
LocalFree
LockFileEx
GetFileSize
SetEnvironmentVariableA
GetProcessHeap
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
MoveFileW
FlushFileBuffers
SetNamedPipeHandleState
SetLastError
DisconnectNamedPipe
GetOverlappedResult
WaitNamedPipeW
CreateNamedPipeW
PeekNamedPipe
LocalAlloc
LoadLibraryW
GetProcAddress
ConnectNamedPipe
TerminateProcess
GetModuleFileNameW
OpenProcess
MoveFileExW
GetModuleHandleW
TryEnterCriticalSection
HeapCreate
EnterCriticalSection
OutputDebugStringA
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
GetTempPathW
CreateMutexW
WaitForSingleObject
GetCurrentThreadId
HeapValidate
HeapSize
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
GetSystemInfo
HeapCompact
HeapDestroy
DeleteCriticalSection
GetCurrentProcessId
Sleep
FreeLibrary
FormatMessageA
QueryPerformanceCounter
GetTickCount
CreateThread
FormatMessageW
QueryFullProcessImageNameW
CreateEventW
SetEvent
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
TerminateThread
TlsSetValue
DeviceIoControl
TlsAlloc
TlsGetValue
TlsFree
GetModuleHandleExW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
VirtualFree
GetEnvironmentVariableW
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemDirectoryA
GetFileType
GetACP
ConvertFiberToThread
ConvertThreadToFiberEx
RtlVirtualUnwind
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetDateFormatW
SetFilePointerEx
GetCommandLineW
GetCommandLineA
FileTimeToSystemTime
MultiByteToWideChar
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
FindClose
GetEnvironmentVariableA
UnlockFileEx
SetEndOfFile
SetFilePointer
LockFile
GetProcessId
SetFileTime
RemoveDirectoryW
GetDiskFreeSpaceW
WriteFile
GetStdHandle
GetCurrentProcess
FindNextFileW
GetFullPathNameW
HeapFree
FindFirstFileW
ReadFile
CreateDirectoryW
AreFileApisANSI
GetTempPathA
GetLastError
GetSystemDirectoryW
GetFileInformationByHandle
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
GetConsoleOutputCP
GetTimeZoneInformation
SetStdHandle
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LoadLibraryExW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
CompareFileTime
SleepEx
GetCPInfo
GetStringTypeW
SetEnvironmentVariableW
WriteConsoleW
SystemTimeToFileTime
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetNativeSystemInfo
QueryPerformanceFrequency
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

advapi32

SetSecurityDescriptorDacl
CryptHashData
CryptGetHashParam
InitializeAcl
InitializeSecurityDescriptor
FreeSid
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegEnumKeyExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
SetSecurityDescriptorSacl
SetEntriesInAclW
AllocateAndInitializeSid
OpenProcessToken
AdjustTokenPrivileges
GetLengthSid
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
OpenSCManagerW
DeleteService
ControlService
StartServiceW
OpenServiceW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

bcrypt

BCryptGenRandom

wldap32

ord27
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord26
ord117
ord41
ord208
ord73
ord216
ord14
ord46
ord219

normaliz

IdnToAscii

Exports

Exports

unqlite_begin
unqlite_close
unqlite_commit
unqlite_config
unqlite_kv_cursor_data
unqlite_kv_cursor_data_callback
unqlite_kv_cursor_delete_entry
unqlite_kv_cursor_key
unqlite_kv_cursor_key_callback
unqlite_kv_cursor_next_entry
unqlite_kv_cursor_prev_entry
unqlite_kv_cursor_reset
unqlite_kv_cursor_seek
unqlite_kv_cursor_valid_entry
unqlite_lib_config
unqlite_lib_copyright
unqlite_lib_ident
unqlite_lib_init
unqlite_lib_is_threadsafe
unqlite_lib_shutdown
unqlite_lib_signature
unqlite_lib_version
unqlite_open
unqlite_rollback
unqlite_util_load_mmaped_file
unqlite_util_random_num
unqlite_util_random_string
unqlite_util_release_mmaped_file
unqlite_vm_config

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb0355cb85545dabc29b1e9b1344a319

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

ws2_32

iphlpapi

crypt32

kernel32

user32

advapi32

bcrypt

wldap32

normaliz

Exports

Exports

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 47KB - Virtual size: 98KB

.pdata Size: 219KB - Virtual size: 218KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 49KB - Virtual size: 48KB

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 47KB - Virtual size: 98KB

.pdata
Size: 219KB - Virtual size: 218KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 49KB - Virtual size: 48KB