kudos | Triage

Sharing

Copy URL Twitter E-mail

General

Target

kudos
Size

1.5MB
MD5

400da9f83fc783dfab375cdc160b7baa
SHA1

7b94f33138a59c81c39f049d7152dc82d40fe207
SHA256

4d258bc6bc2c8fdf1e62fb90fa2d8389d9904a93c358c8f33d10cec617cb08e5
SHA512

08a81f141659304c8e4d610775f970936333361ac32f1e69c2bbb28993353e9f62b14a7904882ffa65a03cea1aa31bfc57cf125c351bd5f5bc295072a9bf3609
SSDEEP

24576:+7geLgtf6w8/VBXbIQj3qltNeXU3LFAmlg0KDHY1e5rX5cqQQ1FIW:+LANGVBXbvj35XUKDHJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kudos

Files

kudos
.exe windows:6 windows x64

3c5cde04a70b1f84e9c4523c4e764082

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
CloseHandle
ReleaseMutex
FindClose
ReleaseSRWLockShared
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
GetCurrentProcess
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
SetFilePointerEx
SetFileInformationByHandle
DuplicateHandle
GetStdHandle
GetCurrentProcessId
WaitForSingleObject
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
FindNextFileW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
CreateDirectoryW
FindFirstFileW
GetFileInformationByHandleEx
GetModuleHandleW
FormatMessageW
GetFullPathNameW
IsProcessorFeaturePresent
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetTempPathW
GetConsoleMode
WriteConsoleW
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memmove
memset
memcmp
memcpy
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_exit
exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm_e
_set_app_type
_seh_filter_exe
__p___argc
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 909KB - Virtual size: 908KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 576KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c5cde04a70b1f84e9c4523c4e764082

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 909KB - Virtual size: 908KB

.rdata Size: 576KB - Virtual size: 576KB

.data Size: 512B - Virtual size: 920B

.pdata Size: 34KB - Virtual size: 33KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 909KB - Virtual size: 908KB

.rdata
Size: 576KB - Virtual size: 576KB

.data
Size: 512B - Virtual size: 920B

.pdata
Size: 34KB - Virtual size: 33KB

.reloc
Size: 16KB - Virtual size: 15KB