36e8b4642da4c298bb4deb1b33db9a79bc577b9a8e1830e3668db12c1c8c1826

Sharing

Copy URL Twitter E-mail

General

Target

36e8b4642da4c298bb4deb1b33db9a79bc577b9a8e1830e3668db12c1c8c1826
Size

3.0MB
MD5

bf002239a2ef64c18baba48098b8e49a
SHA1

fae06baae147a2eb668261f7c82a319846085112
SHA256

36e8b4642da4c298bb4deb1b33db9a79bc577b9a8e1830e3668db12c1c8c1826
SHA512

1715ac456eb33fc43779638f0c00e216aaee60ab585ca46c069783aa038695c8e334473cb968407c7ff85376b0c5cb271405804e41824816f81b8d37f9a845f9
SSDEEP

49152:wCkE7Qn2UUPmXciQx1eXKbCq3EvzFbdbdPWV/WbstE0qGNN+44uc84Dl:wCkNFJ6bbUrFbdb8V/u0qgN+Fuc8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36e8b4642da4c298bb4deb1b33db9a79bc577b9a8e1830e3668db12c1c8c1826

Files

36e8b4642da4c298bb4deb1b33db9a79bc577b9a8e1830e3668db12c1c8c1826
.exe windows x64

f00121bbc4d29e6885ff6cf8b14aaacd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

userenv

LoadUserProfileW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

ws2_32

inet_ntoa
inet_ntop
WSACleanup
FreeAddrInfoW
bind
inet_pton
WSASend
shutdown
listen
WSAStartup
getpeername
getsockname
socket
gethostname
GetAddrInfoW
WSARecv
getsockopt
WSAGetOverlappedResult
setsockopt
WSAGetLastError
closesocket
WSADuplicateSocketW
WSASocketW
ntohl
htonl
htons
getnameinfo
ntohs
getservbyname
WSAIoctl

secur32

InitSecurityInterfaceW
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
LsaLogonUser

kernel32

PeekNamedPipe
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
GetCurrentDirectoryW
SetEnvironmentVariableW
DeleteFileW
GetFullPathNameW
SetFileAttributesW
Sleep
GetConsoleOutputCP
SetConsoleMode
SetConsoleOutputCP
GetModuleFileNameW
FormatMessageA
TerminateProcess
WaitForSingleObject
CloseHandle
GetCurrentProcessId
GetExitCodeProcess
CreateDirectoryW
GetConsoleScreenBufferInfo
GetCurrentProcess
GetStdHandle
CreateFileW
GetLastError
FreeConsole
LoadLibraryW
GetProcAddress
LocalFree
MoveFileExW
GetComputerNameW
FreeLibrary
WideCharToMultiByte
GetFileType
SetHandleInformation
SetEndOfFile
GetCurrentThreadId
DuplicateHandle
GetTickCount64
SetFilePointerEx
CreateProcessW
OpenThread
FlushFileBuffers
SetEvent
ResetEvent
VerSetConditionMask
SleepEx
VerifyVersionInfoW
CreateEventA
ExpandEnvironmentStringsW
FindFirstFileExW
GetWindowsDirectoryW
GetModuleHandleExW
SystemTimeToFileTime
GetSystemTime
MultiByteToWideChar
FillConsoleOutputCharacterA
SetConsoleTextAttribute
SetConsoleScreenBufferSize
ScrollConsoleScreenBufferA
GetConsoleCursorInfo
GetConsoleCP
SetConsoleWindowInfo
GetConsoleMode
FileTimeToSystemTime
SetConsoleCursorInfo
ReadConsoleInputW
CreateFileA
WriteConsoleOutputA
FillConsoleOutputAttribute
PeekConsoleInputW
WriteConsoleW
Beep
SetConsoleCP
GetConsoleWindow
SetConsoleCursorPosition
ReadConsoleOutputA
SetConsoleCtrlHandler
QueueUserAPC
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CancelIo
CreateNamedPipeA
DeviceIoControl
WriteFileEx
CreateHardLinkW
GetFileInformationByHandle
RtlUnwind
ReadFileEx
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
GetFinalPathNameByHandleW
LoadLibraryExW
CreateWaitableTimerA
ReadFile
WriteFile
CancelSynchronousIo
CancelIoEx
ReleaseMutex
CreateMutexA
VirtualAlloc
VirtualFree
InitOnceExecuteOnce
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RemoveDirectoryW
SetStdHandle
ExitProcess
RtlPcToFileHeader
FindNextFileW
ReadConsoleW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
CreatePipe
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
HeapReAlloc
GetFileSizeEx
GetStringTypeW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetProcessHeap
SystemTimeToTzSpecificLocalTime
FindClose
HeapSize
GetSystemDirectoryW
GetFileAttributesExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException

user32

GetWindowPlacement
ShowWindow

advapi32

ConvertSidToStringSidA
LsaManageSidNameMapping
AdjustTokenPrivileges
AllocateLocallyUniqueId
EqualSid
AllocateAndInitializeSid
LookupPrivilegeValueA
CreateRestrictedToken
FreeSid
LsaNtStatusToWinError
EventWriteTransfer
EventRegister
EventUnregister
RegCloseKey
RegOpenKeyExW
ConvertSidToStringSidW
LookupAccountSidW
RegQueryValueExW
GetSidIdentifierAuthority
CreateProcessAsUserW
GetAce
CreateWellKnownSid
CopySid
GetNamedSecurityInfoW
IsValidSid
IsValidSecurityDescriptor
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetLengthSid
IsValidAcl
LookupAccountNameW
GetTokenInformation
IsWellKnownSid

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f00121bbc4d29e6885ff6cf8b14aaacd

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

userenv

crypt32

ws2_32

secur32

kernel32

user32

advapi32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 29KB - Virtual size: 188KB

.pdata Size: 51KB - Virtual size: 50KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 192KB - Virtual size: 192KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 29KB - Virtual size: 188KB

.pdata
Size: 51KB - Virtual size: 50KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 192KB - Virtual size: 192KB

.reloc
Size: 17KB - Virtual size: 17KB