f907aa9c7864155d6cc356c68d787dac7694ff6d0aa7a27c21fead75430dd8d0

Sharing

Copy URL Twitter E-mail

General

Target

f907aa9c7864155d6cc356c68d787dac7694ff6d0aa7a27c21fead75430dd8d0
Size

1.9MB
MD5

37d71f76dd11c40360d7cea6f8fd7f3b
SHA1

82440a583d601955164d61c9425718e8455f5c94
SHA256

f907aa9c7864155d6cc356c68d787dac7694ff6d0aa7a27c21fead75430dd8d0
SHA512

9097e57a10e105f8239b7f583891e2385a0ef980c12104b86971e3d379149903e1604da94fd91b424a5b2230722b4917e7b4516f52bd371cd3ebb13e6efe85a2
SSDEEP

49152:NVmleVvo22xCzAeYGkgr1WEUbBan1cjIU6idF:CYeteQBi+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f907aa9c7864155d6cc356c68d787dac7694ff6d0aa7a27c21fead75430dd8d0

Files

f907aa9c7864155d6cc356c68d787dac7694ff6d0aa7a27c21fead75430dd8d0
.exe windows x64

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions

kernel32

FindClose
SetThreadErrorMode
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
CompareStringOrdinal
GetProcessId
GetComputerNameExW
GetCurrentProcessId
CreateFileW
LocalAlloc
OpenProcess
SetCurrentDirectoryW
MoveFileExW
Sleep
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
CreateRemoteThreadEx
RemoveDirectoryW
DeleteFileW
CopyFileExW
LoadLibraryExW
FreeLibrary
GetProcAddress
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
WakeAllConditionVariable
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
VirtualQueryEx
GetSystemInfo
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ConnectNamedPipe
ReadFile
WriteFile
CancelIoEx
CreateNamedPipeW
GetModuleHandleA
ReleaseSRWLockExclusive
WakeConditionVariable
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
GetCurrentProcess
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlCaptureContext
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
WriteFileEx
CreateEventW
CancelIo
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
CreateIoCompletionPort
RtlVirtualUnwind
GetCurrentThreadId
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
SetUnhandledExceptionFilter
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
FindFirstFileW
SwitchToThread
GetExitCodeProcess
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
GetLastError
ReadFileEx
SleepEx
CloseHandle
InitializeSListHead
IsDebuggerPresent
SleepConditionVariableSRW
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
GetStringTypeW
RtlPcToFileHeader
RaiseException
GetFileType
SetStdHandle
SetEnvironmentVariableW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
IsValidCodePage
FindFirstFileExW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
TlsFree
UnhandledExceptionFilter

ntdll

NtReadFile
NtQuerySystemInformation
NtQueryInformationProcess
RtlGetVersion
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile

iphlpapi

GetExtendedUdpTable
FreeMibTable
GetIfTable2
GetExtendedTcpTable

advapi32

FreeSid
SetEntriesInAclW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetUserNameW

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear

pdh

PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExA
GetModuleFileNameExW
GetPerformanceInfo

shell32

CommandLineToArgvW

ws2_32

WSAGetLastError
closesocket
connect
getsockname
setsockopt
ioctlsocket
send
WSASend
recv
WSASocketW
WSACleanup
WSAStartup
getaddrinfo
freeaddrinfo
getsockopt
select
bind

d3d11

D3D11CreateDevice

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory1

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 635KB - Virtual size: 634KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

ntdll

iphlpapi

advapi32

netapi32

ole32

oleaut32

pdh

powrprof

psapi

shell32

ws2_32

d3d11

bcrypt

dxgi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 635KB - Virtual size: 634KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 64KB - Virtual size: 63KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 635KB - Virtual size: 634KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 64KB - Virtual size: 63KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 9KB - Virtual size: 8KB