f3bc959099c6beb8e02df20203f7d9cdb0f7a4199263ebe104b7c954a7159596

Sharing

Copy URL

Twitter E-mail

General

Target

f3bc959099c6beb8e02df20203f7d9cdb0f7a4199263ebe104b7c954a7159596
Size

4.8MB
MD5

60d2e25d143465a7c4b47e9d3fa7349d
SHA1

3545aff7e2be9a9da0c67172ed000a870037e813
SHA256

f3bc959099c6beb8e02df20203f7d9cdb0f7a4199263ebe104b7c954a7159596
SHA512

c72904a09d5af735d574b737e1e3b82ade9f6cad26ef3e9d2120c26cc1b6241cd2a347d3a786acaba48f84d4f9d8ddff49b6a47e7702a364998c46e73e9c7731
SSDEEP

49152:AA/asrp88cVwAsOnA0JYM0eMHBGtlq1DqjYIU6iRn8Y/VDoYqpxtKCgqBb424qOO:l98bA0Coyin+RpUgqBbDKqnwKI4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3bc959099c6beb8e02df20203f7d9cdb0f7a4199263ebe104b7c954a7159596

Files

f3bc959099c6beb8e02df20203f7d9cdb0f7a4199263ebe104b7c954a7159596
.exe windows x64

ea19fad7034fac26044aac90e32071e5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

DeregisterEventSource
GetUserNameA
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegisterEventSourceW
ReportEventW

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetBitmapBits
SelectObject

iphlpapi

GetAdaptersAddresses

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
ConvertFiberToThread
ConvertThreadToFiberEx
CopyFileA
CreateDirectoryA
CreateFiberEx
CreateProcessA
CreateSemaphoreW
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FormatMessageW
FreeLibrary
GetACP
GetConsoleMode
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExA
GetEnvironmentVariableW
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersion
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
InitializeCriticalSection
InitializeSRWLock
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
RaiseException
ReadConsoleA
ReadConsoleW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleMode
SetFileAttributesA
SetLastError
SetUnhandledExceptionFilter
Sleep
SwitchToFiber
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
Wow64DisableWow64FsRedirection
WriteFile
lstrlenW

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_access
_acmdln
_amsg_exit
_cexit
_errno
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_findfirst64
_fileno
_findnext64
_fmode
_fstat64
_fullpath
_gmtime64
_initterm
_lseeki64
_mkdir
_onexit
_pclose
_popen
_read
_setmode
_snwprintf
_stat64
_strdup
_strdup
_strnicmp
_time64
_vsnprintf
_vsnwprintf
_wfopen
_wgetcwd
_time64
_wpopen
_write
_write
abort
atoi
calloc
ctime
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fgetws
fopen
fprintf
fputc
fputs
fputwc
fread
free
fseek
fsetpos
ftell
fwprintf
fwprintf
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
qsort
raise
rand
realloc
setlocale
setvbuf
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
vswprintf_s
wcscoll
wcscpy
wcsftime
wcslen
wcsstr
wcstombs
wcsxfrm

shlwapi

PathFindExtensionW
PathFindFileNameA
PathFindFileNameW

user32

CloseClipboard
GetClipboardData
GetDC
GetDesktopWindow
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowRect
MessageBoxA
MessageBoxW
OpenClipboard
ReleaseDC
ShowWindow

ws2_32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
shutdown
socket

sqlite3

sqlite3_close
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_text
sqlite3_finalize
sqlite3_open
sqlite3_prepare_v2
sqlite3_step

libcurl-x64

curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_easy_strerror
curl_formadd
curl_formfree
curl_global_init
curl_mime_addpart
curl_mime_filedata
curl_mime_free
curl_mime_init
curl_mime_name
curl_slist_append

libsodium-23

sodium_base642bin

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 373KB - Virtual size: 373KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea19fad7034fac26044aac90e32071e5

Headers

File Characteristics

Imports

advapi32

bcrypt

crypt32

gdi32

iphlpapi

kernel32

msvcrt

shlwapi

user32

ws2_32

sqlite3

libcurl-x64

libsodium-23

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.data Size: 23KB - Virtual size: 22KB

.rdata Size: 720KB - Virtual size: 720KB

.pdata Size: 173KB - Virtual size: 172KB

.xdata Size: 220KB - Virtual size: 220KB

.bss Size: - Virtual size: 15KB

.idata Size: 11KB - Virtual size: 11KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

/4 Size: 87KB - Virtual size: 87KB

/19 Size: 3.4MB - Virtual size: 3.4MB

/31 Size: 12KB - Virtual size: 12KB

/45 Size: 275KB - Virtual size: 274KB

/57 Size: 373KB - Virtual size: 373KB

/70 Size: 65KB - Virtual size: 64KB

/81 Size: 9KB - Virtual size: 8KB

/92 Size: 94KB - Virtual size: 93KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 23KB - Virtual size: 22KB

.rdata
Size: 720KB - Virtual size: 720KB

.pdata
Size: 173KB - Virtual size: 172KB

.xdata
Size: 220KB - Virtual size: 220KB

.bss
Size: - Virtual size: 15KB

.idata
Size: 11KB - Virtual size: 11KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

/4
Size: 87KB - Virtual size: 87KB

/19
Size: 3.4MB - Virtual size: 3.4MB

/31
Size: 12KB - Virtual size: 12KB

/45
Size: 275KB - Virtual size: 274KB

/57
Size: 373KB - Virtual size: 373KB

/70
Size: 65KB - Virtual size: 64KB

/81
Size: 9KB - Virtual size: 8KB

/92
Size: 94KB - Virtual size: 93KB