63d45c92daccfd22756375dfbcba5755c8315b8a51308966792127acdc746edb

Sharing

Copy URL Twitter E-mail

General

Target

63d45c92daccfd22756375dfbcba5755c8315b8a51308966792127acdc746edb
Size

235KB
MD5

043c030a75b8b34a7ba25046e2f6610c
SHA1

204eeedcc1e13b49df0dba93209d68edd63c28ea
SHA256

63d45c92daccfd22756375dfbcba5755c8315b8a51308966792127acdc746edb
SHA512

7b3a14d426993d2232fb1ad0b57efde7681be77b020d1b9e478e7a197ff624ebe22bd013428e95532eb868363e42e057d2305a0b46dae695e0e197f55047b565
SSDEEP

6144:ldnrKDm8Apb5+dTPYsrRA9GYRy1n9AgCYxQDxHbxD:lV0mL5oBRA9dc9KtH9D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BitsArbitraryFileMoveExploit.exe

Files

63d45c92daccfd22756375dfbcba5755c8315b8a51308966792127acdc746edb
.zip
BitsArbitraryFileMoveExploit.exe
.exe windows:6 windows x64

309796be824484fd53021aaad9a6ee86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

OpenProcessToken
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateProcessAsUserW

user32

UnregisterClassW

ole32

CoInitializeEx
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoTaskMemFree
StringFromCLSID
CLSIDFromString
CoCreateInstance
CoGetStdMarshalEx
CoMarshalInterface
CoUninitialize
CreateStreamOnHGlobal
StringFromIID
CoCreateGuid
CoInitialize

oleaut32

SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
CreateErrorInfo
SetErrorInfo
VariantChangeType
VariantInit
VariantClear
GetErrorInfo
CreateTypeLib2
LoadTypeLi

kernel32

SetFilePointerEx
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
GetModuleFileNameA
HeapQueryInformation
HeapReAlloc
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetProcessHeap
OutputDebugStringA
CreateThread
WaitForSingleObjectEx
GetCurrentThreadId
GetCurrentThread
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LoadLibraryExW
CreateFileW
DeleteFileW
FindFirstFileW
FindNextFileW
GetFileSize
QueryDosDeviceW
ReadFile
WriteFile
DecodePointer
CloseHandle
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
CreateEventW
GetCurrentProcess
GetCurrentProcessId
ProcessIdToSessionId
GetWindowsDirectoryW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
GetModuleFileNameW
LocalAlloc
LocalFree
FormatMessageW
lstrlenW
CopyFileW
GetStdHandle
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
GetTempPathW
Sleep
SetConsoleTextAttribute
SetLastError
GetFullPathNameW
GetModuleHandleW
GetProcAddress
GetFileInformationByHandle
DeviceIoControl
GetOverlappedResult
WaitForSingleObject
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
DuplicateHandle
EnterCriticalSection
LeaveCriticalSection
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
FreeLibrary
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetSystemInfo
EncodePointer
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetFileType
WriteConsoleW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineW
FatalAppExitA
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
CreateSemaphoreW
HeapSize
HeapValidate
VirtualQuery

shell32

ShellExecuteW

shlwapi

PathFindFileNameW
PathIsDirectoryW
PathRemoveFileSpecW

Sections

.text
Size: 662KB - Virtual size: 661KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

309796be824484fd53021aaad9a6ee86

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

ole32

oleaut32

kernel32

shell32

shlwapi

Sections

.text Size: 662KB - Virtual size: 661KB

.rdata Size: 201KB - Virtual size: 200KB

.data Size: 10KB - Virtual size: 33KB

.pdata Size: 30KB - Virtual size: 30KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 662KB - Virtual size: 661KB

.rdata
Size: 201KB - Virtual size: 200KB

.data
Size: 10KB - Virtual size: 33KB

.pdata
Size: 30KB - Virtual size: 30KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB