02c4a808f0e14c89172384d3c1113e5d762864e76564b685c2c922fcb8ed859a

Sharing

Copy URL Twitter E-mail

General

Target

02c4a808f0e14c89172384d3c1113e5d762864e76564b685c2c922fcb8ed859a
Size

768KB
MD5

4211c02478d98d1839cb37e986d90c39
SHA1

fc616f527b319e72cf694faacfaf25b126c6fcee
SHA256

02c4a808f0e14c89172384d3c1113e5d762864e76564b685c2c922fcb8ed859a
SHA512

79489bdefc6be48823c5b3402512669e35ea77e52ef4e0b9f2f335beba1e4aaeb35fbeba448a73598a6adc1abf02b8af39e5b9f07b29b86726023cbebf8fcc93
SSDEEP

12288:LltXeyJ6uFi8OX0OkAZvzCUrFcrL1xRnW4GVTJpVekwqndW8:LltOyJlIXA4bCUrFc31xRnOJpVlwqdr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02c4a808f0e14c89172384d3c1113e5d762864e76564b685c2c922fcb8ed859a

Files

02c4a808f0e14c89172384d3c1113e5d762864e76564b685c2c922fcb8ed859a
.exe windows x64

8cd67e61d70a40acb22e89f46e40ada3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

ws2_32

WSAEventSelect
connect
getpeername
getsockname
bind
WSAIoctl
getsockopt
htons
ntohs
recv
WSAStartup
WSAEnumNetworkEvents
WSASetLastError
WSACreateEvent
__WSAFDIsSet
select
WSACleanup
accept
WSACloseEvent
htonl
listen
WSAWaitForMultipleEvents
closesocket
getaddrinfo
freeaddrinfo
gethostbyname
recvfrom
sendto
ioctlsocket
gethostname
send
WSAGetLastError
socket
setsockopt
WSAResetEvent

kernel32

TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FindClose
FindNextFileA
lstrlenA
FindFirstFileA
SetFileAttributesA
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
CompareStringEx
LCMapStringEx
LocalFree
SizeofResource
HeapFree
GetCurrentProcess
InitializeCriticalSectionEx
WaitForSingleObject
UnmapViewOfFile
HeapSize
Sleep
GetLastError
GetFileAttributesA
SetEvent
LockResource
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
GetLocalTime
DecodePointer
HeapDestroy
DeleteCriticalSection
GetCurrentProcessId
ResetEvent
WideCharToMultiByte
OpenFileMappingA
CreateDirectoryA
CreateEventA
IsProcessorFeaturePresent
WriteFile
DeviceIoControl
GetModuleHandleA
CreateFileA
GetSystemDirectoryA
GetProcAddress
GetModuleFileNameA
WritePrivateProfileStringA
GetPrivateProfileStringA
MultiByteToWideChar
CreateProcessA
ReadFile
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryW
InitializeSRWLock
GetModuleHandleW
LoadLibraryW
WaitForSingleObjectEx
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
SetLastError
FormatMessageW
VerSetConditionMask
VerifyVersionInfoW
MoveFileExW
MapViewOfFile
InitializeCriticalSectionAndSpinCount
CreateEventW
InitializeSListHead
AcquireSRWLockShared
ReleaseSRWLockShared
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetProcessHeap
FreeLibrary
GetSystemTimeAsFileTime
EncodePointer

comdlg32

GetFileTitleA

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CreateServiceA
RegCloseKey
CloseServiceHandle
OpenSCManagerA
StartServiceA
RegSetValueExA
RegOpenKeyExA
OpenServiceA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
AddAce
GetAce
GetAclInformation
InitializeAcl
LookupAccountNameA
CopySid
GetLengthSid
IsValidSid
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shlwapi

PathAddBackslashA
PathIsDirectoryA
PathRemoveFileSpecA
PathRemoveBackslashA
PathRemoveExtensionA
PathFileExistsA

rpcrt4

UuidCreate

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall
__std_terminate
__std_exception_copy
__std_exception_destroy
strrchr
memcmp
strchr
memcpy
memchr
_CxxThrowException
__uncaught_exception
__current_exception_context
__current_exception
strstr
memset
__C_specific_handler
memmove

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_beginthreadex
strerror
_invalid_parameter_noinfo
terminate
_errno
__p___argv
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_getpid
_cexit
_configure_narrow_argv
_initialize_narrow_environment
abort
__sys_nerr
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strnlen
strcpy_s
strcat_s
strcspn
strpbrk
isspace
_wcsdup
tolower
isupper
isalnum
strncpy
strcmp
strspn
wcspbrk
strncmp
_stricmp
islower
_strdup
__strncnt

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr
_mbscmp
_mbsnbcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vsscanf
_set_fmode
fwrite
_wfopen
__acrt_iob_func
fread
setvbuf
fclose
fseek
fgets
_lseeki64
_open
_fseeki64
_close
_write
_read
fsetpos
fflush
__stdio_common_vsprintf
feof
fopen
fputs
__stdio_common_vsprintf_s
__p__commode
fputc
_get_stream_buffer_pointers
ungetc
fgetpos
fgetc

api-ms-win-crt-heap-l1-1-0

realloc
_callnewh
malloc
free
_set_new_mode
calloc

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
wcstombs
strtoll
strtol

api-ms-win-crt-filesystem-l1-1-0

_access
_wstat64
_stat64
_waccess
_unlock_file
_fstat64
_lock_file
_unlink
_splitpath

api-ms-win-crt-locale-l1-1-0

_lock_locales
___lc_collate_cp_func
___lc_codepage_func
___lc_locale_name_func
___mb_cur_max_func
_unlock_locales
_configthreadlocale
__pctype_func
localeconv
setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
frexp

api-ms-win-crt-utility-l1-1-0

rand_s
qsort

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

shell32

SHGetSpecialFolderPathA

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 447KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8cd67e61d70a40acb22e89f46e40ada3

Headers

DLL Characteristics

File Characteristics

Imports

wldap32

ws2_32

kernel32

comdlg32

advapi32

shlwapi

rpcrt4

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

shell32

ole32

Sections

.text Size: 447KB - Virtual size: 447KB

.rdata Size: 284KB - Virtual size: 284KB

.data Size: 8KB - Virtual size: 15KB

.pdata Size: 23KB - Virtual size: 23KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 447KB - Virtual size: 447KB

.rdata
Size: 284KB - Virtual size: 284KB

.data
Size: 8KB - Virtual size: 15KB

.pdata
Size: 23KB - Virtual size: 23KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB