c952436e9e8e547cc869b43307eb7b2719245b8ee188d364c05e1425016d3319

Sharing

Copy URL

Twitter E-mail

General

Target

c952436e9e8e547cc869b43307eb7b2719245b8ee188d364c05e1425016d3319
Size

155KB
MD5

94c89cd8cee4ff8e1af098e3872941e3
SHA1

6eacdbc61a53c5343053d7cd3ff32e2c6287e4f8
SHA256

c952436e9e8e547cc869b43307eb7b2719245b8ee188d364c05e1425016d3319
SHA512

c1db3c72710485a0df172d1d790abbd397a4668a08137a89fc74152ea9fdfe1ece65310ae8119814821a31cc086174dfde975b68c0ce644243b892410288994b
SSDEEP

1536:nO60QmYdxrVTPpa5CVLAYUWRIsa8LgkLQaNngmecRewoT/v7F9lr1Qfx:rPiYUWRmtglNngB7F9t1Qfx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c952436e9e8e547cc869b43307eb7b2719245b8ee188d364c05e1425016d3319

Files

c952436e9e8e547cc869b43307eb7b2719245b8ee188d364c05e1425016d3319
.exe windows:6 windows x64

860b8a28672def67ddf6c7249fdd1351

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

miktex230900-app

?Trace@Application@App@MiKTeX@@UEAA_NAEBUTraceMessage@TraceCallback@03@@Z
?OnProgress@Application@App@MiKTeX@@UEAA_NW4Notification@Packages@3@@Z
?OnRetryableError@Application@App@MiKTeX@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ReportLine@Application@App@MiKTeX@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?TryCreateFile@Application@App@MiKTeX@@UEAA_NAEBVPathName@Util@3@W4FileType@Core@3@@Z
?InstallPackage@Application@App@MiKTeX@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVPathName@Util@3@AEAV673@@Z
?ShowLibraryVersions@Application@App@MiKTeX@@UEBAXXZ
?GetDependencies@Runtime@vi@App@MiKTeX@@SA?AV?$vector@ULibraryVersion@Core@MiKTeX@@V?$allocator@ULibraryVersion@Core@MiKTeX@@@std@@@std@@XZ
??0Application@App@MiKTeX@@QEAA@XZ
??1Application@App@MiKTeX@@UEAA@XZ
?Init@Application@App@MiKTeX@@UEAAXAEAV?$vector@PEADV?$allocator@PEAD@std@@@std@@@Z
?Finalize2@Application@App@MiKTeX@@UEAAXH@Z
?FatalError@Application@App@MiKTeX@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Sorry@Application@App@MiKTeX@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMiKTeXException@Core@3@@Z
?Sorry@Application@App@MiKTeX@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVexception@5@@Z
?GetSession@Application@App@MiKTeX@@QEBA?AV?$shared_ptr@VSession@Core@MiKTeX@@@std@@XZ
?ExamineArgs@Application@App@MiKTeX@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@PEADV?$allocator@PEAD@std@@@5@AEAVInitInfo@Session@Core@3@@Z
?ExamineArgs@Application@App@MiKTeX@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@PEBDV?$allocator@PEBD@std@@@5@AEAVInitInfo@Session@Core@3@@Z
?Init@Application@App@MiKTeX@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?Init@Application@App@MiKTeX@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Init@Application@App@MiKTeX@@UEAAXAEAV?$vector@PEBDV?$allocator@PEBD@std@@@std@@@Z
?Init@Application@App@MiKTeX@@UEAAXAEBVInitInfo@Session@Core@3@@Z
?Init@Application@App@MiKTeX@@UEAAXAEBVInitInfo@Session@Core@3@AEAV?$vector@PEADV?$allocator@PEAD@std@@@std@@@Z
?Finalize@Application@App@MiKTeX@@UEAAXXZ
?Init@Application@App@MiKTeX@@UEAAXAEBVInitInfo@Session@Core@3@AEAV?$vector@PEBDV?$allocator@PEBD@std@@@std@@@Z
?GetVersion@Runtime@vi@App@MiKTeX@@SA?AUVersionNumber@Core@4@XZ

miktex230900-popt

poptGetNextOpt
poptGetArgs
poptFreeContext
poptHelpOptions
poptBadOption
poptGetContext
poptGetOptArg
poptStrerror

miktex230900-core

?MakeProgramVersionString@Utils@Core@MiKTeX@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV45@AEBUVersionNumber@23@@Z
?Exists@File@Core@MiKTeX@@SA_NAEBVPathName@Util@3@@Z
?Start@Process@Core@MiKTeX@@SA?AV?$unique_ptr@VProcess@Core@MiKTeX@@U?$default_delete@VProcess@Core@MiKTeX@@@std@@@std@@AEBUProcessStartInfo@23@@Z
?FatalMiKTeXError@Session@Core@MiKTeX@@SAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000AEBVKVMAP@MiKTeXException@23@AEBUSourceLocation@23@@Z
?GetPosition@FileStream@Core@MiKTeX@@UEBAJXZ
?Seek@FileStream@Core@MiKTeX@@UEAAXJW4SeekOrigin@23@@Z
?Write@FileStream@Core@MiKTeX@@UEAAXPEBX_K@Z
?Read@FileStream@Core@MiKTeX@@UEAA_KPEAX_K@Z
?ReadLine@StreamReader@Core@MiKTeX@@QEAA_NAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1StreamReader@Core@MiKTeX@@UEAA@XZ
??1FileStream@Core@MiKTeX@@UEAA@XZ
?Save@MiKTeXException@Core@MiKTeX@@QEBA_NXZ
??0SourceLocation@Core@MiKTeX@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0H@Z
?Parse@VersionNumber@Core@MiKTeX@@SA?AU123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ToString@VersionNumber@Core@MiKTeX@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1ConsoleCodePageSwitcher@Core@MiKTeX@@UEAA@XZ
??0ConsoleCodePageSwitcher@Core@MiKTeX@@QEAA@XZ
?GetExeName@Utils@Core@MiKTeX@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

miktex230900-util

?WideCharToUTF8@StringUtil@Util@MiKTeX@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEB_W@Z
?CopyString@StringUtil@Util@MiKTeX@@SA_KPEA_W_KPEBD@Z
?Convert@PathName@Util@MiKTeX@@QEAAAEAV123@V?$OptionSet@W4ConvertPathNameOption@Util@MiKTeX@@$0CA@@23@@Z
?CutOffLastComponent@PathName@Util@MiKTeX@@QEAAAEAV123@_N@Z
?Compare@PathName@Util@MiKTeX@@SAHPEBD0@Z
??1Tokenizer@Util@MiKTeX@@UEAA@XZ
??0Tokenizer@Util@MiKTeX@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??BTokenizer@Util@MiKTeX@@QEBA_NXZ
??DTokenizer@Util@MiKTeX@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?CopyString@StringUtil@Util@MiKTeX@@SA_KPEAD_KPEBD@Z
??ETokenizer@Util@MiKTeX@@QEAAAEAV012@XZ

miktex230900-fmt

?vformat@v9@fmt@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v9@fmt@@D@v9@fmt@@@12@@Z

kernel32

GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerifyVersionInfoW
Sleep
VerSetConditionMask

user32

DdeDisconnect
DdeUninitialize
DdeGetData
DdeFreeStringHandle
DdeGetLastError
DdeCreateStringHandleW
DdeClientTransaction
DdeConnect
DdeInitializeW

shell32

FindExecutableA

msvcp140

_Mbrtowc
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ

vcruntime140

memcpy
__current_exception_context
__std_type_info_destroy_list
__C_specific_handler
memset
memmove
__current_exception
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_cexit
_crt_atexit
_crt_at_quick_exit
terminate
_initialize_wide_environment
_errno
_register_thread_local_exe_atexit_callback
__p___argc
_exit
_invalid_parameter_noinfo_noreturn
__p___wargv
_get_initial_wide_environment
_configure_wide_argv
_c_exit
_set_app_type
_seh_filter_exe
exit
_initterm_e
_execute_onexit_table
_initterm

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-heap-l1-1-0

calloc
malloc
_callnewh
free
_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

arctrlmain

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

860b8a28672def67ddf6c7249fdd1351

Headers

DLL Characteristics

File Characteristics

Imports

miktex230900-app

miktex230900-popt

miktex230900-core

miktex230900-util

miktex230900-fmt

kernel32

user32

shell32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 102KB - Virtual size: 102KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 5KB - Virtual size: 5KB

.idata Size: 16KB - Virtual size: 15KB

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 904B

.text
Size: 102KB - Virtual size: 102KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 5KB - Virtual size: 5KB

.idata
Size: 16KB - Virtual size: 15KB

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 904B