df84745bcfdd0920ef3000fe4a352703d0afe6eb8f539bf6b9845e24d74bd85d

Sharing

Copy URL

Twitter E-mail

General

Target

df84745bcfdd0920ef3000fe4a352703d0afe6eb8f539bf6b9845e24d74bd85d
Size

1.9MB
MD5

02b612edb25848fae34ca265ae304afe
SHA1

8f48f430f6d26c337229c554fcbfad3d857fdb53
SHA256

df84745bcfdd0920ef3000fe4a352703d0afe6eb8f539bf6b9845e24d74bd85d
SHA512

12acd8bba35a4750398afdbd50b3e2c962732bbf9ccca40039f0fecc5ef673b0e9ea6bcd83fff5324b462647eb8a15074a1fcce506ae9f926e6f09af21f79274
SSDEEP

49152:NVmleVvo22xCzAeYGkgr1WEUbPan1cjIU6idF:CYeteQPi+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df84745bcfdd0920ef3000fe4a352703d0afe6eb8f539bf6b9845e24d74bd85d

Files

df84745bcfdd0920ef3000fe4a352703d0afe6eb8f539bf6b9845e24d74bd85d
.exe windows:6 windows x64

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions

kernel32

FindClose
SetThreadErrorMode
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
CompareStringOrdinal
GetProcessId
GetComputerNameExW
GetCurrentProcessId
CreateFileW
LocalAlloc
OpenProcess
SetCurrentDirectoryW
MoveFileExW
Sleep
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
CreateRemoteThreadEx
RemoveDirectoryW
DeleteFileW
CopyFileExW
LoadLibraryExW
FreeLibrary
GetProcAddress
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
WakeAllConditionVariable
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
VirtualQueryEx
GetSystemInfo
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ConnectNamedPipe
ReadFile
WriteFile
CancelIoEx
CreateNamedPipeW
GetModuleHandleA
ReleaseSRWLockExclusive
WakeConditionVariable
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
GetCurrentProcess
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlCaptureContext
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
WriteFileEx
CreateEventW
CancelIo
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
CreateIoCompletionPort
RtlVirtualUnwind
GetCurrentThreadId
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
SetUnhandledExceptionFilter
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
FindFirstFileW
SwitchToThread
GetExitCodeProcess
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
GetLastError
ReadFileEx
SleepEx
CloseHandle
InitializeSListHead
IsDebuggerPresent
SleepConditionVariableSRW
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
GetStringTypeW
RtlPcToFileHeader
RaiseException
GetFileType
SetStdHandle
SetEnvironmentVariableW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
IsValidCodePage
FindFirstFileExW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
TlsFree
UnhandledExceptionFilter

ntdll

NtReadFile
NtQuerySystemInformation
NtQueryInformationProcess
RtlGetVersion
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile

iphlpapi

GetExtendedUdpTable
FreeMibTable
GetIfTable2
GetExtendedTcpTable

advapi32

FreeSid
SetEntriesInAclW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetUserNameW

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear

pdh

PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExA
GetModuleFileNameExW
GetPerformanceInfo

shell32

CommandLineToArgvW

ws2_32

WSAGetLastError
closesocket
connect
getsockname
setsockopt
ioctlsocket
send
WSASend
recv
WSASocketW
WSACleanup
WSAStartup
getaddrinfo
freeaddrinfo
getsockopt
select
bind

d3d11

D3D11CreateDevice

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory1

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 635KB - Virtual size: 634KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

ntdll

iphlpapi

advapi32

netapi32

ole32

oleaut32

pdh

powrprof

psapi

shell32

ws2_32

d3d11

bcrypt

dxgi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 635KB - Virtual size: 634KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 64KB - Virtual size: 63KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 635KB - Virtual size: 634KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 64KB - Virtual size: 63KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 9KB - Virtual size: 8KB