b942e2db3f066d6279f6542a1cce126bb977c6575e4b895dc9c600d3db0dbc1b

Sharing

Copy URL Twitter E-mail

General

Target

b942e2db3f066d6279f6542a1cce126bb977c6575e4b895dc9c600d3db0dbc1b
Size

1.9MB
MD5

89f4255b5bc7284892445db55b818bcd
SHA1

7cc6a5cf188a77d670a931239ed9d1b08c9fcd6b
SHA256

b942e2db3f066d6279f6542a1cce126bb977c6575e4b895dc9c600d3db0dbc1b
SHA512

0f53958762278d90762a887763be0532bfd9a4f5090a33406378fe2ec5162ec4b5dfae120ebb3b5a31ad444e954d7e744697ccba518288a98728c40082d5de2f
SSDEEP

49152:NVmleVvo22xCzAeYGkgr1WEUbUan1cjIU6idF:CYeteQUi+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b942e2db3f066d6279f6542a1cce126bb977c6575e4b895dc9c600d3db0dbc1b

Files

b942e2db3f066d6279f6542a1cce126bb977c6575e4b895dc9c600d3db0dbc1b
.exe windows x64

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions

kernel32

FindClose
SetThreadErrorMode
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
CompareStringOrdinal
GetProcessId
GetComputerNameExW
GetCurrentProcessId
CreateFileW
LocalAlloc
OpenProcess
SetCurrentDirectoryW
MoveFileExW
Sleep
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
CreateRemoteThreadEx
RemoveDirectoryW
DeleteFileW
CopyFileExW
LoadLibraryExW
FreeLibrary
GetProcAddress
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
WakeAllConditionVariable
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
VirtualQueryEx
GetSystemInfo
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ConnectNamedPipe
ReadFile
WriteFile
CancelIoEx
CreateNamedPipeW
GetModuleHandleA
ReleaseSRWLockExclusive
WakeConditionVariable
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
GetCurrentProcess
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlCaptureContext
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
WriteFileEx
CreateEventW
CancelIo
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
CreateIoCompletionPort
RtlVirtualUnwind
GetCurrentThreadId
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
SetUnhandledExceptionFilter
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
FindFirstFileW
SwitchToThread
GetExitCodeProcess
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
GetLastError
ReadFileEx
SleepEx
CloseHandle
InitializeSListHead
IsDebuggerPresent
SleepConditionVariableSRW
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
GetStringTypeW
RtlPcToFileHeader
RaiseException
GetFileType
SetStdHandle
SetEnvironmentVariableW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
IsValidCodePage
FindFirstFileExW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
TlsFree
UnhandledExceptionFilter

ntdll

NtReadFile
NtQuerySystemInformation
NtQueryInformationProcess
RtlGetVersion
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile

iphlpapi

GetExtendedUdpTable
FreeMibTable
GetIfTable2
GetExtendedTcpTable

advapi32

FreeSid
SetEntriesInAclW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetUserNameW

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear

pdh

PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExA
GetModuleFileNameExW
GetPerformanceInfo

shell32

CommandLineToArgvW

ws2_32

WSAGetLastError
closesocket
connect
getsockname
setsockopt
ioctlsocket
send
WSASend
recv
WSASocketW
WSACleanup
WSAStartup
getaddrinfo
freeaddrinfo
getsockopt
select
bind

d3d11

D3D11CreateDevice

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory1

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 635KB - Virtual size: 634KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

ntdll

iphlpapi

advapi32

netapi32

ole32

oleaut32

pdh

powrprof

psapi

shell32

ws2_32

d3d11

bcrypt

dxgi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 635KB - Virtual size: 634KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 64KB - Virtual size: 63KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 635KB - Virtual size: 634KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 64KB - Virtual size: 63KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 9KB - Virtual size: 8KB