dd80b836ed6b3665734e11fb1fda4a3bbbb0a0efea963467b2eae91fc526e50b

Sharing

Copy URL

Twitter E-mail

General

Target

dd80b836ed6b3665734e11fb1fda4a3bbbb0a0efea963467b2eae91fc526e50b
Size

4.8MB
MD5

779ccb9cbfe91c692aca14b1d82d6664
SHA1

65a4d1f401113c3f9981f1f4464ad5155118588f
SHA256

dd80b836ed6b3665734e11fb1fda4a3bbbb0a0efea963467b2eae91fc526e50b
SHA512

e6c4718bb161f136e4fb5d3d2d4d9fd1d1987fae14878e80e0ed3dc0d382f6c64644b203aeecde8ba3950ebc8b59bdd45d68005d42a391a4c81311fc00b8204d
SSDEEP

49152:AA/asrp88cVwAsOnA0JYM0eMHBGtlq1DqjYIU6iRn8Y/VDoYqpxtKCgqBb424qOU:l98bA0Coyin+RpUgqBbDKqnwKIO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd80b836ed6b3665734e11fb1fda4a3bbbb0a0efea963467b2eae91fc526e50b

Files

dd80b836ed6b3665734e11fb1fda4a3bbbb0a0efea963467b2eae91fc526e50b
.exe windows x64

ea19fad7034fac26044aac90e32071e5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

DeregisterEventSource
GetUserNameA
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegisterEventSourceW
ReportEventW

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetBitmapBits
SelectObject

iphlpapi

GetAdaptersAddresses

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
ConvertFiberToThread
ConvertThreadToFiberEx
CopyFileA
CreateDirectoryA
CreateFiberEx
CreateProcessA
CreateSemaphoreW
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FormatMessageW
FreeLibrary
GetACP
GetConsoleMode
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExA
GetEnvironmentVariableW
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersion
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
InitializeCriticalSection
InitializeSRWLock
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
RaiseException
ReadConsoleA
ReadConsoleW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleMode
SetFileAttributesA
SetLastError
SetUnhandledExceptionFilter
Sleep
SwitchToFiber
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
Wow64DisableWow64FsRedirection
WriteFile
lstrlenW

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_access
_acmdln
_amsg_exit
_cexit
_errno
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_findfirst64
_fileno
_findnext64
_fmode
_fstat64
_fullpath
_gmtime64
_initterm
_lseeki64
_mkdir
_onexit
_pclose
_popen
_read
_setmode
_snwprintf
_stat64
_strdup
_strdup
_strnicmp
_time64
_vsnprintf
_vsnwprintf
_wfopen
_wgetcwd
_time64
_wpopen
_write
_write
abort
atoi
calloc
ctime
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fgetws
fopen
fprintf
fputc
fputs
fputwc
fread
free
fseek
fsetpos
ftell
fwprintf
fwprintf
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
qsort
raise
rand
realloc
setlocale
setvbuf
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
vswprintf_s
wcscoll
wcscpy
wcsftime
wcslen
wcsstr
wcstombs
wcsxfrm

shlwapi

PathFindExtensionW
PathFindFileNameA
PathFindFileNameW

user32

CloseClipboard
GetClipboardData
GetDC
GetDesktopWindow
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowRect
MessageBoxA
MessageBoxW
OpenClipboard
ReleaseDC
ShowWindow

ws2_32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
shutdown
socket

sqlite3

sqlite3_close
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_text
sqlite3_finalize
sqlite3_open
sqlite3_prepare_v2
sqlite3_step

libcurl-x64

curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_easy_strerror
curl_formadd
curl_formfree
curl_global_init
curl_mime_addpart
curl_mime_filedata
curl_mime_free
curl_mime_init
curl_mime_name
curl_slist_append

libsodium-23

sodium_base642bin

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 373KB - Virtual size: 373KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea19fad7034fac26044aac90e32071e5

Headers

File Characteristics

Imports

advapi32

bcrypt

crypt32

gdi32

iphlpapi

kernel32

msvcrt

shlwapi

user32

ws2_32

sqlite3

libcurl-x64

libsodium-23

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.data Size: 23KB - Virtual size: 22KB

.rdata Size: 720KB - Virtual size: 720KB

.pdata Size: 173KB - Virtual size: 172KB

.xdata Size: 220KB - Virtual size: 220KB

.bss Size: - Virtual size: 15KB

.idata Size: 11KB - Virtual size: 11KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

/4 Size: 87KB - Virtual size: 87KB

/19 Size: 3.4MB - Virtual size: 3.4MB

/31 Size: 12KB - Virtual size: 12KB

/45 Size: 275KB - Virtual size: 274KB

/57 Size: 373KB - Virtual size: 373KB

/70 Size: 65KB - Virtual size: 64KB

/81 Size: 9KB - Virtual size: 8KB

/92 Size: 94KB - Virtual size: 93KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 23KB - Virtual size: 22KB

.rdata
Size: 720KB - Virtual size: 720KB

.pdata
Size: 173KB - Virtual size: 172KB

.xdata
Size: 220KB - Virtual size: 220KB

.bss
Size: - Virtual size: 15KB

.idata
Size: 11KB - Virtual size: 11KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

/4
Size: 87KB - Virtual size: 87KB

/19
Size: 3.4MB - Virtual size: 3.4MB

/31
Size: 12KB - Virtual size: 12KB

/45
Size: 275KB - Virtual size: 274KB

/57
Size: 373KB - Virtual size: 373KB

/70
Size: 65KB - Virtual size: 64KB

/81
Size: 9KB - Virtual size: 8KB

/92
Size: 94KB - Virtual size: 93KB