ae3fffd7feacd5520a234bd368cb19f7bb78f7bff0c2b39ee66606606f321c6a

Sharing

Copy URL Twitter E-mail

General

Target

ae3fffd7feacd5520a234bd368cb19f7bb78f7bff0c2b39ee66606606f321c6a
Size

1.1MB
MD5

0f8296d7196e925cad38dafb2606acc1
SHA1

92828fe6a577475a3c1e3701a15dc66a48f21e9d
SHA256

ae3fffd7feacd5520a234bd368cb19f7bb78f7bff0c2b39ee66606606f321c6a
SHA512

8b40ea6106860daba7ab1fdb4f3f5dd2e4ecf34fad26d2002324ebc846f6009944676026b5a5218721f2cd653b3df13a5e6faddec4d0a03604841671eee2d16f
SSDEEP

24576:hy3unORGDQrxpmlbBW8sRPEbyJlTaN8D1o:AcOdrSFBURPcyJpaNIK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae3fffd7feacd5520a234bd368cb19f7bb78f7bff0c2b39ee66606606f321c6a

Files

ae3fffd7feacd5520a234bd368cb19f7bb78f7bff0c2b39ee66606606f321c6a
.exe windows x64

92f1e4888252b623c2951b4a1ec5cb4a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
GetModuleFileNameW
GetProcAddress
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
HeapSize

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
GetCommandLineW
FreeEnvironmentStringsW
GetStdHandle
SetStdHandle
GetCommandLineA
SetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread
CreateThread
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
CreateProcessW
ExitThread
GetCurrentProcessId
GetStartupInfoW
TerminateProcess
GetProcessId
GetCurrentProcess
TlsAlloc
GetCurrentThreadId

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
SetEvent
InitializeCriticalSectionEx
ResetEvent
CreateEventW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
FlushViewOfFile
OpenFileMappingW

api-ms-win-core-localization-l1-2-0

EnumSystemLocalesW
GetOEMCP
GetACP
IsValidCodePage
FormatMessageA
FormatMessageW
GetUserDefaultLCID
LCMapStringEx
IsValidLocale
GetLocaleInfoW
GetCPInfo
LCMapStringW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-file-l1-1-0

DeleteFileW
WriteFile
SetEndOfFile
SetFilePointerEx
GetFileType
GetFileAttributesExW
FlushFileBuffers
ReadFile
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileSizeEx

user32

MessageBoxW

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW
GetStringTypeW

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
Sleep

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlCaptureContext

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-console-l1-1-0

ReadConsoleW
WriteConsoleA
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

shell32

SHGetKnownFolderPath

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

oleaut32

GetErrorInfo
SysAllocString
SysStringLen
SysFreeString
SetErrorInfo

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Sections

.text
Size: 401KB - Virtual size: 401KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

92f1e4888252b623c2951b4a1ec5cb4a

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-file-l1-1-0

user32

api-ms-win-core-com-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-datetime-l1-1-0

shell32

api-ms-win-core-console-l2-1-0

oleaut32

api-ms-win-core-libraryloader-l1-2-1

Sections

.text Size: 401KB - Virtual size: 401KB

.rdata Size: 131KB - Virtual size: 131KB

.data Size: 19KB - Virtual size: 26KB

.pdata Size: 20KB - Virtual size: 20KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 401KB - Virtual size: 401KB

.rdata
Size: 131KB - Virtual size: 131KB

.data
Size: 19KB - Virtual size: 26KB

.pdata
Size: 20KB - Virtual size: 20KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 572KB - Virtual size: 576KB