6821c1f92d1e9252a7e432029e3323e6a1b54dbbd7cf7cfcbffecb3db50a0473

Sharing

Copy URL Twitter E-mail

General

Target

6821c1f92d1e9252a7e432029e3323e6a1b54dbbd7cf7cfcbffecb3db50a0473
Size

3.9MB
MD5

b627e92dff888fabd2160383690c4f26
SHA1

18ea2b060f58b20b9d8f8c9971461988b57a92e3
SHA256

6821c1f92d1e9252a7e432029e3323e6a1b54dbbd7cf7cfcbffecb3db50a0473
SHA512

3593d2eb41b722245c55e25e5a1e7362818af75a7c563fad47775107a4cb60a9c197ac2e62a4ac58d924fa1d9da9c5f5aed5c5c8a015ce071816bca122e253b7
SSDEEP

49152:3pEbJyfuKynpkY2wdMlXc7qMAsJP+QOwVda5gdmBK8ojqjr:ljkOe+/iUK8ojq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6821c1f92d1e9252a7e432029e3323e6a1b54dbbd7cf7cfcbffecb3db50a0473

Files

6821c1f92d1e9252a7e432029e3323e6a1b54dbbd7cf7cfcbffecb3db50a0473
.exe windows:6 windows x64

60ca1fb8ca1b3b8acc9f5c19eb5994f0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
NtReadFile
NtWriteFile
NtCreateFile
NtDeviceIoControlFile
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
RtlGetNtVersionNumbers
NtCancelIoFileEx
RtlNtStatusToDosError

kernel32

FlsSetValue
FlsGetValue
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetOEMCP
GetCPInfo
SetStdHandle
GetStringTypeW
GetACP
IsValidCodePage
FindFirstFileExW
FlsFree
GetCommandLineA
CompareStringW
FlsAlloc
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LCMapStringW
EnterCriticalSection
SetHandleInformation
EncodePointer
GetCurrentProcessId
RaiseException
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
HeapSize
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexW
GetLastError
GetCurrentProcess
DuplicateHandle
GetSystemInfo
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
WriteFile
GetSystemTimeAsFileTime
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
GetProcessHeap
HeapFree
TlsSetValue
TlsGetValue
CreateThread
HeapAlloc
LoadLibraryA
FreeLibrary
WideCharToMultiByte
WaitForSingleObject
WriteConsoleW
FormatMessageW
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
MultiByteToWideChar
GetConsoleOutputCP
GetFileAttributesW
FreeEnvironmentStringsW
ReleaseMutex
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
LeaveCriticalSection
CreateProcessW
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetStdHandle
WriteFileEx
SleepEx
ReadFileEx
GetExitCodeProcess
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetWindowsDirectoryW
HeapReAlloc
WaitForSingleObjectEx
CreateMutexA
FindNextFileW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
CopyFileExW
CreateEventW
CancelIo
GetConsoleMode
GetFileType
GetSystemDirectoryW
GetModuleHandleW
GetModuleFileNameW
SetCurrentDirectoryW
ExitProcess
GetFullPathNameW
SystemTimeToFileTime
CreateNamedPipeW
WaitForMultipleObjects

ws2_32

getsockopt
ioctlsocket
connect
bind
WSASocketW
getpeername
getsockname
shutdown
recv
send
WSASend
setsockopt
closesocket
WSAGetLastError
WSAIoctl
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo

secur32

AcquireCredentialsHandleA
EncryptMessage
FreeCredentialsHandle
AcceptSecurityContext
FreeContextBuffer
DecryptMessage
ApplyControlToken
DeleteSecurityContext
InitializeSecurityContextW
QueryContextAttributesW

crypt32

CertDuplicateCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertFreeCertificateContext
CertDuplicateCertificateContext

advapi32

SystemFunction036
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

oleaut32

SysFreeString
SysStringLen
GetErrorInfo

bcrypt

BCryptGenRandom

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60ca1fb8ca1b3b8acc9f5c19eb5994f0

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

ws2_32

secur32

crypt32

advapi32

oleaut32

bcrypt

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 15KB - Virtual size: 19KB

.pdata Size: 141KB - Virtual size: 140KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 15KB - Virtual size: 19KB

.pdata
Size: 141KB - Virtual size: 140KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 23KB - Virtual size: 23KB