9d65639afe48b6a1a7063e0722d27638c4774551211a9550a3d7b207924c9c73

Sharing

Copy URL Twitter E-mail

General

Target

9d65639afe48b6a1a7063e0722d27638c4774551211a9550a3d7b207924c9c73
Size

1.3MB
MD5

8dfe228824fa7c8e845af79092b17b28
SHA1

ff72a9d63e5d26ba815f85bd70ff90f63e806115
SHA256

9d65639afe48b6a1a7063e0722d27638c4774551211a9550a3d7b207924c9c73
SHA512

705dd2efe7aaf74f217e71b4bcf311c456b4b57773eb29fcdd97eb4a64a58f2f05c466a8b13a3dfb28a58e4af82c8ca0c97829e415fba92ea225e1b381d0f8dd
SSDEEP

12288:OqZIN6cs9aCi3h3siRmKj0SA8QUXOFb3kYkxvV9NFZla7npwKBLPIUUuTQabWm:O78aCkh3/N28jXOFbEvrdla26TzUab9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9d65639afe48b6a1a7063e0722d27638c4774551211a9550a3d7b207924c9c73

Files

9d65639afe48b6a1a7063e0722d27638c4774551211a9550a3d7b207924c9c73
.exe windows x64

2e6ac496bd3093c4af65dc9d3b1bcb76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
CreateEventW
DeleteCriticalSection
WaitForSingleObject
SetEvent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-management-l1-1-0

StartServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
OpenServiceW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError

api-ms-win-core-localization-l1-2-0

GetOEMCP
IsValidCodePage
GetACP
LCMapStringW
FormatMessageW
GetCPInfo

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-core-registry-l2-1-0

RegCreateKeyW
RegDeleteKeyW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetProcAddress
GetModuleFileNameW
LoadLibraryExW

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleCP
GetConsoleMode

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
GetCommandLineW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStdHandle
SetEnvironmentVariableW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemDirectoryW

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetExitCodeProcess
CreateProcessW
ExitProcess
CreateThread

api-ms-win-core-file-l1-1-0

FindClose
DeleteFileW
CreateFileW
FindFirstFileW
GetFileType
CreateDirectoryW
WriteFile
GetFileAttributesW
FindFirstFileExW
SetFilePointerEx
FlushFileBuffers
FindNextFileW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource

kernel32

__C_specific_handler
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsAlloc
FlsSetValue

api-ms-win-core-heap-l1-1-0

HeapSize
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
CompareStringW

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2e6ac496bd3093c4af65dc9d3b1bcb76

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

advapi32

kernel32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

Sections

.text Size: 67KB - Virtual size: 67KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 67KB - Virtual size: 67KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.2MB