5770709132c2ff289b297b98cfbdcaa03a43043c0de67181f1a8b686f8defcb6

Sharing

Copy URL Twitter E-mail

General

Target

5770709132c2ff289b297b98cfbdcaa03a43043c0de67181f1a8b686f8defcb6
Size

359KB
MD5

577524fb4cf8126155f2277738d2f2d6
SHA1

70e4120b56356031d84aaec82785fd998e2d393c
SHA256

5770709132c2ff289b297b98cfbdcaa03a43043c0de67181f1a8b686f8defcb6
SHA512

ad8622a986a4ba85d4befc469213c33f3ddfb675a81a466f1331e1f34c839fe263f79c6a94f9e66b991bbb68665dd08b3224a0733c23c0712374295649df6a1c
SSDEEP

6144:vMTMFu+kfXDoXv17xtflOXeqHi93JQIsDzpc9KP6n3sDWKe2R8:07C/tfQvIB5n3sSK+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5770709132c2ff289b297b98cfbdcaa03a43043c0de67181f1a8b686f8defcb6

Files

5770709132c2ff289b297b98cfbdcaa03a43043c0de67181f1a8b686f8defcb6
.exe windows x64

535ff57f3cc6eaf2a0a67a4e55b52ab7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery

msvcrt

__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fileno
_fmode
_initterm
_onexit
_setjmp
_setmode
abort
calloc
exit
fflush
fprintf
fputc
free
fwrite
longjmp
malloc
memcmp
memcpy
printf
rand
signal
strcmp
strlen
strncmp
vfprintf

user32

MessageBoxA

Exports

Exports

Calc__76oader_632
DefaultRandSeed__pureZrandom_13
Dl_1023419688_
Dl_1073741835_
Dl_1342179856_
Dl_1342181870_
Dl_1342181994_
Dl_1375736472_
Dl_1392509344_
Dl_1862271080_
Dl_1862271094_
Dl_1862271099_
Dl_1862271115_
Dl_1862271126_
Dl_1862271139_
Dl_1862271146_
Dl_1862271149_
Dl_1862271157_
Dl_1862271273_
Dl_1862271558_
Dl_1862271569_
Dl_1862271573_
Dl_1862271574_
Dl_2231381438_
Dl_3019898891_
Dl_452984969_
GetPPEB__76oader_197
HowMuchTimeWouldYoulikeToSleep__76oader_696
LoaderDatInit000
MyGetCurrentProcessId__76oader_513
MyGetCurrentProcess__76oader_511
MyGetProcAddress__76oader_1808
MyLoadLibraryA__76oader_1807
MyOpenProcess__76oader_514
MyVirtualAllocEx__76oader_512
MyVirtualProtect__76oader_515
NTIarithmeticdefect__cT9c9bHlHSpA1QTnKbHjnIkA_
NTIbcgrmproc__7kPg4iIrFVxPW1SngAif2w_
NTIbool__VaVACK0bpYmqIQ0mKcHfQQ_
NTIbyte__k3HXouOuhqAKq0dx450lXQ_
NTIcatchableerror__qrLSDoe2oBoAqNtJ9badtnA_
NTIcint__nlCscttRCss70IBTyuBqnA_
NTIcstring__S9agCYBinaYZnGWcjTdxclg_
NTIdefect__LbeSGvgPzGzXnW9caIkJqMA_
NTIexception__XEycrCsme5C8CVWAYEcdBQ_
NTIfilehandle__2gIj3gQlK3HZJjQaYCP6ZQ_
NTIhcryptprov__hMQEc0FMry7Up7EoPki79aA_
NTIint4954__kDPg4wXyR8DDyA0MeEjIsw_
NTIint5150__sVg18TP9cLifHyygRe9cro9aA_
NTIint__rR5Bzr1D5krxoo1NcNyeMA_
NTIioerror__iLZrPn9anoh9ad1MmO0RczFw_
NTInode58objecttype__qoL7wM9aSvuu9cy9c5SZOvzXA_
NTInode__IF5ibiUw6rgdOsnsSu5E1Q_
NTIobject__diB2NTuAIWY0FO9c5IUJRGg_
NTIoserror__BeJgrOdDsczOwEWOZbRfKA_
NTIoverflowdefect__9cxMi1BPLc3UKt9br86bGfGQ_
NTIpointer__vr5DoT1jILTGdRlYv1OYpw_
NTIprocLs58streamT58boolLOpkocall_gcsafeOT__9bmhFrLahRsL2hltfRDVtlQ_
NTIprocLs58streamT58intLOpkocall_gcsafeOT__xflqkf2D1uVClg70czEDHA_
NTIprocLs58streamTLOpkocall_gcsafeOT__JQrsH08b4uPTH9cyFPlVOZg_
NTIprocLs58stream_buffer58pointer_buflen58intT58intLOpkocall_gcsafeOT__2VVzVL9bOnKhj1eZKkf9cEuA_
NTIprocLs58stream_buffer58pointer_buflen58intTLOpkocall_gcsafeOT__ki6p1QyfOkJLQJ9aw5NI0AQ_
NTIprocLs58stream_buffer58varstring_slice58sliceLsystemOintTT58intLOpkocall_gcsafeOT__c9c0f59ak4YGQ6neEym8LPKw_
NTIprocLs58stream_unvv58varstringT58boolLOpkocall_gcsafeOT__7jFfqMk9ajToCz6Hv9atCA4A_
NTIprocLs58stream_pos58intTLOpkocall_gcsafeOT__3svSoGIUJIsHkaBL7q4DAQ_
NTIprocLx58timeT58zonedtimeLOclosure_gcsafe_locks5848OT__7xnKxEC24cr3qZyj3gX32w_
NTIprocess__lw7iqc9cC7bi1oOZOAlJkJA_
NTIprocessobj__2rGNQnv9bU4hanI2g3svReg_
NTIprocessoption__bnU6W8LhTMnT4JaSWtGlSA_
NTIqipcproc__BlBp9c2J7tRXTU9adX1vV5gQ_
NTIqpcproc__eV9b9cYSUZoo6tKaCd9b3k9bzA_
NTIquitproc__PD9b9cqhDqM6Xy1oSxwODsOQ_
NTIrefexception__vU9aO9cTqOMn6CBzhV8rX7Sw_
NTIrefioerror__HMIVdYjdZYWskTmTQVo5BQ_
NTIrefobject__HsJiUUcO9cHBdUCi0HwkSTA_
NTIrefoserror__9clYsYwyjCqe2PFTuCI3Ubg_
NTIrefoverflowdefect__r8GBEWywN07B3Rat3azS4Q_
NTIrefreraisedefect__uG62cfJZ15c2siK3CKLmnQ_
NTIrefvalueerror__Ie1m0dv1ZHg72IgPRr1cDw_
NTIreraisedefect__E0L0wGYS1gPD81VLstNO2g_
NTIrootobj__ytyiCJqK439aF9cIibuRVpAg_
NTIseqLbyteT__6H5Oh5UUvVCLiakt9aTwtUQ_
NTIseqLstackxnrbientryT__uB9b75OUPRENsBAu4AnoePA_
NTIseqLstringT__sM4lkSb7zS6F7OVMvW9cffQ_
NTIsetLprocessoptionT__HlmBYNr2gdAZMXOsuiSZ0A_
NTIstackxnrbientry__oLyohQ7O2XOvGnflOss8EA_
NTIstream__1G0jiQbe7KwD5ADza5AZaw_
NTIstreamobj__THYguAi9bSgidczZ3ywEIMQ_
NTIstring__77mFvmsOLKik79ci2hXkHEg_
NTIsystemrng58objecttype__X9aKjcE9bDr41cpowCIZoGpQ_
NTIsystemrng__9aWCZSregXolmau8IgbwrpA_
NTItimezone58objecttype__F8OvqlxXyGXRSiK9c1fCDVw_
NTItimezone__9a5v4OQPlGqsA25ioN8hFYA_
NTIuint5150__JrFyJbYm9b5I4hJ9cWDqvfYA_
NTIuncheckedarrayLutf4954charT__Tyd4y3haUOOHTj71TPIRag_
NTIvalueerror__yoNlBGx0D2tRizIdhQuENw_
NTIwidecstringobj__4HwedE75WPfqZSQ0Cq2OUg_
NaturalToInt32__OOZOOZOOZOpkobleZpkgsZzahzc4551O57O48ZzahzcZwinstr_49
NimMain
NimMainInner
NimMainModule
NtFlushInstructionCacheAddress__70luctuation_86
NtFlushInstructionCache__70luctuation_87
PreMain
PreMainInner
Rcon__OOZOOZOOZOpkobleZpkgsZpkocrypto4548O53O52ZpkocryptoZrijndael_6
SC_Address
SW3_GetRandomSyscallAddress
SW3_GetSyscallAddress
SW3_GetSyscallNumber
SW3_HashSyscall
SW3_PopulateSyscallList
SW3_SyscallList
UTF8minusgtwstring___OOZOOZOOZOpkobleZpkgsZzahzc4551O57O48ZzahzcZwinstr_120
WSAID_ACCEPTEX__windowsZwinlean_713
WSAID_CONNECTEX__windowsZwinlean_712
WSAID_GETACCEPTEXSOCKADDRS__windowsZwinlean_714
WinMain
addChar
addChunkToMatrix__system_4050
addHeapLink__system_4143
addInt__stdZprivateZdigitsutils_164
addInt__stdZprivateZdigitsutils_167
addZCT__system_5365
add__system_2308
add__system_4249
align__system_1624
alloc0Impl__system_1745
alloc0__system_4880
allocAvlNode__system_4118
allocImpl__system_1743
alloc__system_4876
amp___76oader_739
at___76oader_71
baseState__pureZrandom_244
bjyghnqpjyihpusn__76oader_1864
bticlpyykksavce__76oader_223
buildCommandLine__pureZosproc_383
buildEnv__pureZosproc_395
burnMem__OOZOOZOOZOpkobleZpkgsZpkocrypto4548O53O52ZpkocryptoZutils_282
calcRand__76oader_139
calcTheThings__70luctuation_6
calcTheThings__76oader_21
cellSetEnlarge__system_5050
cellSetGet__system_5024
cellSetPut__system_5063
cellSetRawInsert__system_5033
cellsetReset__system_5634
closeThreadAndProcessHandle__pureZosproc_588
close__pureZstreams_57
cmdCount
cmdLine
collectCTBody__system_5941
collectCT__system_5395
collectCycles__system_5861
collectZCT__system_5859
containsOrIncl__system_5163
contains__pureZstrutils_1635
contains__system_4325
contains__system_5085
copyString
copyStringRC1
createAllPipeHandles__pureZosproc_429
createPipeHandles__pureZosproc_458
cstrToNimstr
currException__system_2573
dataPointer__system_5986
dealloc
deallocImpl__system_1747
dealloc__system_4884
decrypt__76oader_1340
dectext__76oader_786
deinit__system_5012
del__system_4258
digits100__stdZprivateZdigitsutils_2
doOperation__system_5402
dollar___systemZdollars_3
dollar___systemZwidestrs_260
dollar___systemZwidestrs_324
dollar___system_2730
echoBinSafe
ectx__76oader_92
enctext__76oader_716
envkey__76oader_719
eqdestroy___systemZassertions_23
errorMessageWriter__system_2528
excHandler__system_2572
excl__system_4378
expandedkey__76oader_722
filyzybqszt__76oader_1865
findNormalized__pureZstrutils_2130
floorDiv__pureZtimes_271
floorMod__pureZtimes_947
fluxedacqguws__76oader_720
forAllChildrenAux__system_5405
forAllChildren__system_5399
forAllSlotsAux__system_5636
framePtr__system_2571
freeBigChunk__system_4595
freeCyclicCell__system_5812
freeHugeChunk__system_4635
fromWinTime__pureZtimes_938
fsLookupTable__system_3918
ftvynzaovdpgr__76oader_1811
gEnv
gHeapidGenerator__system_5585
gSystemRng__OOZOOZOOZOpkobleZpkgsZpkocrypto4548O53O52ZpkocryptoZsysrand_56
g_fluctuate__70luctuation_111
g_fluctuationData__70luctuation_110
g_hookedSleep__70luctuation_109
gcFramePtr__system_2574
gch__system_5318
getActiveStack__system_5507
getBigChunk__system_4616
getBottom__system_4102
getDiscriminant__system_3725
getHugeChunk__system_4631
getOccupiedMem__system_1936
getRandomState__pureZrandom_247
getRefcount
getSmallChunk__system_4639
getTime__pureZtimes_965
get_function_address__76oader_247
get_library_address__76oader_244
gkkaekgaEE__OOZOOZOOZOpkobleZpkgsZstrenc4548O49O49Zstrenc_4
gkzrqkcknjftrvuarll__76oader_280
globalMarkers
globalMarkersLen
globalRaiseHook__system_2291
helper__pureZrandom_55
herqqdrfvuzb__76oader_255
highGauge__system_4207
hijkvnxzwojwzh__76oader_1794
hwnd__76oader_517
hytlqshbmjrqugqknbvafhk__76oader_1795
ilijfwvmdnqqnowmfcmjjbtzhf__76oader_1810
inRange__system_4227
inSeconds__pureZtimes_583
incl__system_4356
incl__system_5117
incrSeqV3
inet_ntop_real__windowsZwinlean_803
initGC__system_2398
initRand__pureZrandom_245
initTime__pureZtimes_899
init__system_4986
init__system_4992
injectCreateRemoteThread__76oader_1869
intSetGet__system_4286
intSetPut__system_4308
interiorAllocatedPtr__system_4843
invalidFormatString__pureZstrutils_2142
isActiveStack__system_5510
isOnStack__system_5397
isOpenArrayStringable__OOZOOZOOZOpkobleZpkgsZzahzc4551O57O48ZzahzcZwinstr_559
is_dll__76oader_242
keySchedule__76oader_926
key__76oader_718
kigntrdjqrwzzkitb__76oader_1809
llAlloc__system_4076
loadLib__pureZdynlib_3
localInstance__pureZtimes_1453
localRaiseHook__system_2294
lowGauge__system_4199
markGlobals__system_5828
markS__system_5820
markStackAndRegisters__system_5878
merge__76oader_572
minus___76oader_404
mnewString
myDup__pureZosproc_424
newOSError__pureZos_445
newObj
newObjNoInit
newObjRC1
newSeq
newSeq__OOZOOZOOZOpkobleZpkgsZpkocrypto4548O53O52ZpkocryptoZutils_237
newWString__OOZOOZOOZOpkobleZpkgsZzahzc4551O57O48ZzahzcZwinstr_66
newWideCString__systemZwidestrs_231
newWideCString__systemZwidestrs_254
newWideCString__systemZwidestrs_257
next__pureZrandom_44
pkoGC_setStackBottom
pkoGCvisit
pkoGetProcAddr
pkoLoadLibrary
pkoLoadLibraryError
pkoRegisterGlobalMarker
pkoRegisterThreadLocalMarker
pko_program_result
pkocrypto_sysrandDatInit000
pkocrypto_sysrandInit000
normalize__pureZtimes_437
nospclose
nospprocessID
nospquoteShell
nospquoteShellWindows
nospstartProcess
nospsuspend
nsuAddf
nsuCmpIgnoreStyle
nsuFindCharSet
nsuFormatSingleElem
ntDiffTime
ntdlldll__70luctuation_85
onUnhandledException__system_2758
opqiwepoausdasdjl__whispersZsyscallsjump_58
oqiahsjynmxkla__whispersZsyscallsjump_50
oqiazasusjk__whispersZsyscallsjump_27
ord__systemZwidestrs_8
ortho__OOZOOZOOZOpkobleZpkgsZpkocrypto4548O53O52ZpkocryptoZrijndael_152
osErrorMsg__pureZos_419
osLastError__pureZos_474
outOfMemHook__system_2296
ownArgv__pureZos_1592
ownParsedArgv__pureZos_1593
oxzdvdldrchfquyauwxrbde__76oader_721
plus___76oader_392
plvbcmfjsnhenljt__76oader_516
prepareDealloc__system_5531
procAddrError
quit__system_7262
raiseEIO__systemZio_96
raiseExceptionAux__system_2873
raiseExceptionEx
raiseOSError__pureZos_471
raiseOutOfMem__system_3791
raiseOverflow
rand__76oader_156
rand__76oader_164
rand__pureZrandom_115
rand__pureZrandom_92
rand__pureZrandom_96
randomize__pureZrandom_268
rawAlloc__system_4660
rawDealloc__system_4789
rawNewObj__system_5748
rawNewString
rawNewStringNoInit
rdFileTime__windowsZwinlean_283
registerSignalHandler__system_2990
remoteProcID__76oader_1868
removeChunkFromMatrix2__system_4041
removeChunkFromMatrix__system_4011
reportUnhandledErrorAux__system_2759
reportUnhandledError__system_2862
requestOsChunks__system_4539
reraiseException
resizeString
rotl__pureZrandom_32
selectBranch__system_3745
setLengthStr
setPosition__system_5501
setPosition__system_5504
showErrorMessage__system_2543
signalHandler
skew__system_4239
skipRandomNumbers__pureZrandom_53
sknanohflvftyhyeyyvswmseiq__76oader_1955
sknujsujaylcsuppzh__76oader_1812
sleep_Address__70luctuation_112
splitBinary__76oader_596
splitChunk2__system_4585
splitChunk__system_4590
split__system_4242
stackSize__system_5485
stackSize__system_5489
state__pureZrandom_14
stdlib_ioDatInit000
stdlib_ioInit000
stdlib_osDatInit000
stdlib_osInit000
stdlib_osprocDatInit000
stdlib_randomInit000
stdlib_streamsDatInit000
stdlib_sysrandDatInit000
stdlib_timesDatInit000
stdlib_timesInit000
stdlib_widestrsDatInit000
stdlib_winleanDatInit000
stdlib_winleanInit000
strDesc__system_2412
subWord__OOZOOZOOZOpkobleZpkgsZpkocrypto4548O53O52ZpkocryptoZrijndael_411
substr__system_7832
success__76oader_8
sweep__system_5816
symAddr__pureZdynlib_30
systemDatInit000
systemInit000
tProcess__76oader_1867
threadLocalMarkers
threadLocalMarkersLen
toNimStr
ttjofhtluhhxjrnaf__76oader_219
unhandledExceptionHook__system_2299
unitWeights__pureZtimes_122
unknown_FluctuationInit000
unmarkStackAndRegisters__system_5933
unsureAsgnRef
uplmlsetudm__76oader_705
urandom__stdZsysrand_32
utcInstance__pureZtimes_1452
uvycsbofokctxjrcql__76oader_363
zahzcConverterBOOLToBoolean__OOZOOZOOZOpkobleZpkgsZzahzc4551O57O48ZzahzcZutils_5
zahzc_shellapiDatInit000
zahzc_winbaseDatInit000
zahzc_winconDatInit000
zahzc_windefDatInit000
zahzc_winstrDatInit000
zahzc_winuserDatInit000
winstrConverterStringToLPWSTR__OOZOOZOOZOpkobleZpkgsZzahzc4551O57O48ZzahzcZwinstr_700
winstrConverterStringToPtrChar__OOZOOZOOZOpkobleZpkgsZzahzc4551O57O48ZzahzcZwinstr_666
wotxtggpjrsxvnmwsobqcupq__76oader_715
writeToStdErr__system_2538
writeWindows__systemZio_205
ws2__windowsZwinlean_804
xjrejbbajpw__76oader_712
ze64__system_292
zmegdemmzswfm__76oader_713
zuatzuastdiasyy__whispersZsyscallsjump_47
zuq8aztsdztausdgbh__whispersZsyscallsjump_34

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 78KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

535ff57f3cc6eaf2a0a67a4e55b52ab7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 47KB

.data Size: 8KB - Virtual size: 8KB

.rdata Size: 271KB - Virtual size: 270KB

.pdata Size: 4KB - Virtual size: 4KB

.xdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 78KB

.edata Size: 16KB - Virtual size: 15KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 244B

.text
Size: 47KB - Virtual size: 47KB

.data
Size: 8KB - Virtual size: 8KB

.rdata
Size: 271KB - Virtual size: 270KB

.pdata
Size: 4KB - Virtual size: 4KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 78KB

.edata
Size: 16KB - Virtual size: 15KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 244B