2811db089c0a52b7f92645b67fd55690b66b7dbb16a27376c3825e47cee10005

Sharing

Copy URL Twitter E-mail

General

Target

2811db089c0a52b7f92645b67fd55690b66b7dbb16a27376c3825e47cee10005
Size

6.0MB
MD5

d1dfb90f670dc418969aed9df5dba3cd
SHA1

ca593754dd03adfd34bd7850db7d27c2ffbef709
SHA256

2811db089c0a52b7f92645b67fd55690b66b7dbb16a27376c3825e47cee10005
SHA512

81ef789cfe732fb078fb20dbf42d8956679d4dcf12880ecf4bb50ece2e4cb7f99f85c90842c10c54d4e85e61c9003207f1787d917d0628690086a4dbcf7fc82a
SSDEEP

98304:kWateGZnQjXwWYKiBeMTDWVbPb+OVlJbKcvqsL2HhScAlZKxpT1QpV8Y4Y1:kWy1ZnQjj8BeMwvVJeAEVAKyp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2811db089c0a52b7f92645b67fd55690b66b7dbb16a27376c3825e47cee10005

Files

2811db089c0a52b7f92645b67fd55690b66b7dbb16a27376c3825e47cee10005
.exe windows x64

133468016d2a989be1d503f2a763c24f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

gdi32

BitBlt

kernel32

AddVectoredExceptionHandler
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

___lc_codepage_func

user32

ActivateKeyboardLayout
CharUpperBuffW

wtsapi32

WTSSendMessageW

Exports

Exports

_cgo_dummy_export
goELEMENT_COMPARATOR
goElementEventProc
goKeyValueCallback
goLPCBYTE_RECEIVER
goLPCSTR_RECEIVER
goLPCWSTR_RECEIVER
goNATIVE_FUNCTOR_INVOKE
goNATIVE_FUNCTOR_RELEASE
goSciterElementCallback
goSciterHostCallback
go_send
hook_create_screen_info
hook_get_auto_repeat_delay
hook_get_auto_repeat_rate
hook_get_multi_click_time
hook_get_pointer_acceleration_multiplier
hook_get_pointer_acceleration_threshold
hook_get_pointer_sensitivity
hook_post_event
hook_run
hook_set_dispatch_proc
hook_set_logger
hook_stop

Sections

.text
Size: - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 452KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

133468016d2a989be1d503f2a763c24f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

user32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 4.4MB

.data Size: - Virtual size: 528KB

.rdata Size: - Virtual size: 4.3MB

.pdata Size: - Virtual size: 14KB

.xdata Size: - Virtual size: 13KB

.bss Size: - Virtual size: 452KB

.edata Size: - Virtual size: 812B

.idata Size: - Virtual size: 7KB

.CRT Size: - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.vmp0 Size: - Virtual size: 3.0MB

.vmp1 Size: 6.0MB - Virtual size: 6.0MB

.reloc Size: 512B - Virtual size: 36B

.rsrc Size: 8KB - Virtual size: 7KB

.text
Size: - Virtual size: 4.4MB

.data
Size: - Virtual size: 528KB

.rdata
Size: - Virtual size: 4.3MB

.pdata
Size: - Virtual size: 14KB

.xdata
Size: - Virtual size: 13KB

.bss
Size: - Virtual size: 452KB

.edata
Size: - Virtual size: 812B

.idata
Size: - Virtual size: 7KB

.CRT
Size: - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.vmp0
Size: - Virtual size: 3.0MB

.vmp1
Size: 6.0MB - Virtual size: 6.0MB

.reloc
Size: 512B - Virtual size: 36B

.rsrc
Size: 8KB - Virtual size: 7KB