6faffbf3ba1fac0350122e38d0b62a1d62077ff65f53d9004372be3be96aa202

Sharing

Copy URL Twitter E-mail

General

Target

6faffbf3ba1fac0350122e38d0b62a1d62077ff65f53d9004372be3be96aa202
Size

1.3MB
MD5

bab183c00bae8e338e9c00fe2b8f085f
SHA1

7b08e7093d3ff5546831c8023fc1dfd31a9761ee
SHA256

6faffbf3ba1fac0350122e38d0b62a1d62077ff65f53d9004372be3be96aa202
SHA512

249b3af6f473dc9baa2c4910eb8365f6ee391d281e8129e71021b80975294d1a9603e143a1557550b42d62330d8899225b159df36ea3eeb60f6b5f0a6c95fcc2
SSDEEP

24576:CeuuhAzO+Qq5NxJtiB2rVykK30OpX2IKjxRmOWFTKpzpS7dW:CeufOU55tiBcbKTpGHTmO6+ROd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6faffbf3ba1fac0350122e38d0b62a1d62077ff65f53d9004372be3be96aa202

Files

6faffbf3ba1fac0350122e38d0b62a1d62077ff65f53d9004372be3be96aa202
.exe windows:6 windows x64

db0dab94225fef23692c8e1575f38f1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetErrorMode

api-ms-win-core-heap-l1-1-0

HeapSize
GetProcessHeap
HeapReAlloc
HeapDestroy
HeapAlloc
HeapFree

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
OpenEventW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
SetEvent
TryEnterCriticalSection
CreateEventW
CreateMutexW
WaitForSingleObject
ReleaseMutex
TryAcquireSRWLockExclusive
ResetEvent
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
SleepConditionVariableCS
WakeAllConditionVariable
InitializeConditionVariable

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

ExitThread
CreateThread
TlsSetValue
GetCurrentProcessId
GetCurrentProcess
GetStartupInfoW
TlsGetValue
TerminateProcess
ResumeThread
TlsAlloc
GetCurrentThreadId
GetExitCodeProcess
ExitProcess
OpenProcessToken
SuspendThread
GetCurrentThread
CreateProcessAsUserW
TlsFree

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
FindResourceExW
GetProcAddress
LoadResource
GetModuleHandleW
GetModuleHandleExW
SizeofResource
LockResource
FreeLibrary

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
InitializeSecurityDescriptor
AdjustTokenPrivileges
SetTokenInformation
SetSecurityDescriptorDacl

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumValueW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCreateKeyExW

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_DevNode_Status
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
CM_Get_Parent
CM_Disable_DevNode
CM_Enable_DevNode
CM_MapCrToWin32Err
CM_Unregister_Notification
CM_Register_Notification
CM_Get_Device_ID_List_SizeW

api-ms-win-core-file-l1-1-0

GetFileType
SetFilePointerEx
GetFileSize
SetEndOfFile
ReadFile
CreateDirectoryW
FindClose
WriteFile
FindFirstFileExW
FindNextFileW
DeleteFileW
CreateFileW
FlushFileBuffers

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetTickCount64
GetVersionExW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemInfo

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService
StartServiceW
CloseServiceHandle
OpenSCManagerW
CreateServiceW
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW

ws2_32

WSACleanup
WSAStartup

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW
CreateToolhelp32Snapshot
Process32NextW

oleaut32

SysAllocStringLen

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalAlloc
LocalFree
GlobalFree

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetStdHandle
SetEnvironmentVariableW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW
K32EnumProcesses
K32EnumProcessModules

api-ms-win-core-heap-obsolete-l1-1-0

GlobalHandle
GlobalLock
GlobalUnlock

rpcrt4

RpcStringFreeW
UuidToStringW

ext-ms-win-networking-wlanapi-l1-1-0

WlanQueryInterface
WlanOpenHandle
WlanFreeMemory
WlanCloseHandle
WlanEnumInterfaces

wlanapi

WlanIhvControl

shlwapi

PathRemoveFileSpecW

setupapi

SetupDiEnumDriverInfoW
SetupDiGetDeviceInstallParamsW
SetupDiDestroyDriverInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDriverInfoDetailW
SetupDiSetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiEnumDeviceInterfaces
SetupDiOpenDevRegKey
SetupDiBuildDriverInfoList
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

wtsapi32

WTSQueryUserToken

dbghelp

MiniDumpWriteDump

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
LCMapStringW
GetCPInfo
FormatMessageW
IsValidCodePage
GetUserDefaultLCID
GetOEMCP
GetACP
EnumSystemLocalesW
IsValidLocale

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlUnwind
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsSetValue
FlsAlloc
FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-console-l1-1-0

GetConsoleCP
ReadConsoleW
SetConsoleCtrlHandler
GetConsoleMode
WriteConsoleW

Sections

.text
Size: 533KB - Virtual size: 533KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

db0dab94225fef23692c8e1575f38f1f

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

ws2_32

api-ms-win-shell-shdirectory-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

userenv

api-ms-win-core-toolhelp-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

rpcrt4

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

setupapi

wtsapi32

dbghelp

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

Sections

.text Size: 533KB - Virtual size: 533KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 4KB - Virtual size: 18KB

.pdata Size: 27KB - Virtual size: 27KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 533KB - Virtual size: 533KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 4KB - Virtual size: 18KB

.pdata
Size: 27KB - Virtual size: 27KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB