e48bbc78487eb1db7bcf022ee8f8fb7a46bee56bdb6294c00ae3851aecdc3eaa

Sharing

Copy URL Twitter E-mail

General

Target

e48bbc78487eb1db7bcf022ee8f8fb7a46bee56bdb6294c00ae3851aecdc3eaa
Size

117KB
MD5

91bc71a23a35c7001302b926ce7d8696
SHA1

f505f7bc7478742f6f68caf2da1c6445e67f5314
SHA256

e48bbc78487eb1db7bcf022ee8f8fb7a46bee56bdb6294c00ae3851aecdc3eaa
SHA512

b950b43e96131ae95a2966147da1068f447945f1c7f38cac1eb990a954cd5631055776610748b68629c24a2a44299392d62b6c39215af826266b91a88b81a9df
SSDEEP

1536:vWxPgp3DswALCN6YF55Ntc/h2v/W1e81LRtD9DY:D0YF5TC/wv/Wo81n9DY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e48bbc78487eb1db7bcf022ee8f8fb7a46bee56bdb6294c00ae3851aecdc3eaa

Files

e48bbc78487eb1db7bcf022ee8f8fb7a46bee56bdb6294c00ae3851aecdc3eaa
.exe windows:6 windows x64

89b8329f29903e9d91e73ebefb88b7e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

miktex230900-getopt

MIKTEX_GETOPT_optind
getopt_long_only
MIKTEX_GETOPT_optarg

miktex230900-app

?Init@Application@App@MiKTeX@@UEAAXAEAV?$vector@PEBDV?$allocator@PEBD@std@@@std@@@Z
?Init@Application@App@MiKTeX@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Init@Application@App@MiKTeX@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?ExamineArgs@Application@App@MiKTeX@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@PEBDV?$allocator@PEBD@std@@@5@AEAVInitInfo@Session@Core@3@@Z
?GetVersion@Runtime@vi@App@MiKTeX@@SA?AUVersionNumber@Core@4@XZ
?GetDependencies@Runtime@vi@App@MiKTeX@@SA?AV?$vector@ULibraryVersion@Core@MiKTeX@@V?$allocator@ULibraryVersion@Core@MiKTeX@@@std@@@std@@XZ
??0Application@App@MiKTeX@@QEAA@XZ
??1Application@App@MiKTeX@@UEAA@XZ
?Init@Application@App@MiKTeX@@UEAAXAEAV?$vector@PEADV?$allocator@PEAD@std@@@std@@@Z
?Finalize@Application@App@MiKTeX@@UEAAXXZ
?ExamineArgs@Application@App@MiKTeX@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@PEADV?$allocator@PEAD@std@@@5@AEAVInitInfo@Session@Core@3@@Z
?GetSession@Application@App@MiKTeX@@QEBA?AV?$shared_ptr@VSession@Core@MiKTeX@@@std@@XZ
?Init@Application@App@MiKTeX@@UEAAXAEBVInitInfo@Session@Core@3@@Z
?Init@Application@App@MiKTeX@@UEAAXAEBVInitInfo@Session@Core@3@AEAV?$vector@PEADV?$allocator@PEAD@std@@@std@@@Z
?Init@Application@App@MiKTeX@@UEAAXAEBVInitInfo@Session@Core@3@AEAV?$vector@PEBDV?$allocator@PEBD@std@@@std@@@Z
?Finalize2@Application@App@MiKTeX@@UEAAXH@Z
?ShowLibraryVersions@Application@App@MiKTeX@@UEBAXXZ
?InstallPackage@Application@App@MiKTeX@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVPathName@Util@3@AEAV673@@Z
?TryCreateFile@Application@App@MiKTeX@@UEAA_NAEBVPathName@Util@3@W4FileType@Core@3@@Z
?EnableInstaller@Application@App@MiKTeX@@QEAAXW4TriState@Configuration@3@@Z
?ReportLine@Application@App@MiKTeX@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?OnRetryableError@Application@App@MiKTeX@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?OnProgress@Application@App@MiKTeX@@UEAA_NW4Notification@Packages@3@@Z
?Trace@Application@App@MiKTeX@@UEAA_NAEBUTraceMessage@TraceCallback@03@@Z

miktex230900-core

?ToString@VersionNumber@Core@MiKTeX@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Parse@VersionNumber@Core@MiKTeX@@SA?AU123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Delete@File@Core@MiKTeX@@SAXAEBVPathName@Util@3@@Z
?ExecuteSystemCommand@Process@Core@MiKTeX@@SA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Run@Process@Core@MiKTeX@@SAXAEBVPathName@Util@3@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?MakeProgramVersionString@Utils@Core@MiKTeX@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV45@AEBUVersionNumber@23@@Z
?PrintException@Utils@Core@MiKTeX@@SAXAEBVexception@std@@@Z
?PrintException@Utils@Core@MiKTeX@@SAXAEBVMiKTeXException@23@@Z
??0CommandLineBuilder@Core@MiKTeX@@QEAA@XZ
??1CommandLineBuilder@Core@MiKTeX@@UEAA@XZ
??0CommandLineBuilder@Core@MiKTeX@@QEAA@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?AppendArgument@CommandLineBuilder@Core@MiKTeX@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ToString@CommandLineBuilder@Core@MiKTeX@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetExeName@Utils@Core@MiKTeX@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?AppendRedirection@CommandLineBuilder@Core@MiKTeX@@QEAAXAEBVPathName@Util@3@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

miktex230900-util

?GetExtension@PathName@Util@MiKTeX@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Convert@PathName@Util@MiKTeX@@QEAAAEAV123@V?$OptionSet@W4ConvertPathNameOption@Util@MiKTeX@@$0CA@@23@@Z
?Split@PathName@Util@MiKTeX@@CAXAEBV123@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@11@Z
?Compare@PathName@Util@MiKTeX@@SAHPEBD0@Z
?WideCharToUTF8@StringUtil@Util@MiKTeX@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEB_W@Z
?CopyString@StringUtil@Util@MiKTeX@@SA_KPEAD_KPEBD@Z
?AppendString@StringUtil@Util@MiKTeX@@SA_KPEAD_KPEBD@Z

miktex230900-fmt

?vformat@v9@fmt@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v9@fmt@@D@v9@fmt@@@12@@Z

msvcp140

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mbrtowc
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

vcruntime140

__std_exception_destroy
_CxxThrowException
__std_exception_copy
strchr
memset
__std_type_info_destroy_list
__C_specific_handler
__current_exception_context
__current_exception
memmove
__std_terminate
memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_seh_filter_dll
_crt_atexit
_crt_at_quick_exit
_invalid_parameter_noinfo_noreturn
terminate
_seh_filter_exe
_execute_onexit_table
_set_app_type
_c_exit
__p___wargv
__p___argc
_cexit
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_register_thread_local_exe_atexit_callback

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
_set_new_mode
calloc

api-ms-win-crt-string-l1-1-0

_strnicmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 719B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89b8329f29903e9d91e73ebefb88b7e4

Headers

DLL Characteristics

File Characteristics

Imports

miktex230900-getopt

miktex230900-app

miktex230900-core

miktex230900-util

miktex230900-fmt

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.idata Size: 14KB - Virtual size: 13KB

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 719B

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.idata
Size: 14KB - Virtual size: 13KB

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 719B