f93cfe308e2113efb1c0ce9ebd3ba344073fc5d5858ee5348541667382233191

Sharing

Copy URL Twitter E-mail

General

Target

f93cfe308e2113efb1c0ce9ebd3ba344073fc5d5858ee5348541667382233191
Size

2.1MB
MD5

18f4e8ec63f2538a6be2524e6767619b
SHA1

06075999cf982b3a20f5a692bc662cd2e5dd97fc
SHA256

f93cfe308e2113efb1c0ce9ebd3ba344073fc5d5858ee5348541667382233191
SHA512

fce16926509b6a3c14cd9f69ac8a2598a6ee20241f0fb94a30367927a58cdbbf274b8015f322d87554e98df499c8259955d330a3cfc6822081fc838ce430d976
SSDEEP

49152:NTNgtsMFiLJmCcb1YMFtdEiZkf1n3dt2r4PRSEk1ul:FGiAC8ZFzKJdt2sEE5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f93cfe308e2113efb1c0ce9ebd3ba344073fc5d5858ee5348541667382233191

Files

f93cfe308e2113efb1c0ce9ebd3ba344073fc5d5858ee5348541667382233191
.exe windows:6 windows x64

a3eeb6629453ddfeeeea62fd47af943d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

FreeResource
FreeLibraryAndExitThread
GetProcAddress
SizeofResource
LockResource
LoadLibraryExW
LoadResource
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
CreateEventW
WaitForSingleObject
SetEvent
ResetEvent
OpenMutexW
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
OpenEventW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

ExitThread
GetExitCodeProcess
TerminateProcess
GetProcessId
CreateProcessAsUserW
CreateThread
SetThreadPriority
GetCurrentProcessId
TlsFree
GetCurrentProcess
OpenProcessToken
TerminateThread
ProcessIdToSessionId
ExitProcess
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetExitCodeThread

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError

api-ms-win-mm-mme-l1-1-0

waveOutClose
waveOutOpen
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
waveOutReset

api-ms-win-core-file-l1-1-0

GetFileSizeEx
GetFileType
FindNextFileW
DeleteFileW
CreateDirectoryW
WriteFile
ReadFile
GetFileAttributesW
CreateFileW
FindFirstFileExW
FlushFileBuffers
SetFilePointer
FindClose
SetFilePointerEx
CompareFileTime

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoInitializeEx

ws2_32

WSAStartup
listen
socket
htons
WSASetServiceW
getsockname
GetHostNameW
bind
WSAGetLastError
ntohs
inet_ntoa
WSACleanup
ntohl
getpeername
accept
recv
send
connect
closesocket
inet_addr

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount
GetWindowsDirectoryW
GetSystemDirectoryW
GetTickCount64

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
SystemTimeToFileTime

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
GetNamedPipeClientProcessId
WTSGetActiveConsoleSessionId

bcrypt

BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptSetProperty
BCryptDecrypt
BCryptGetProperty
BCryptEncrypt

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
HeapSize

crypt32

CryptBinaryToStringA
CryptDecodeObjectEx
CryptImportPublicKeyInfoEx2
CryptEncodeObjectEx
CryptExportPublicKeyInfoFromBCryptKeyHandle
CryptStringToBinaryA

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-1-0

InitializeSecurityDescriptor
DuplicateTokenEx
AdjustTokenPrivileges
AllocateAndInitializeSid
FreeSid
SetTokenInformation
SetSecurityDescriptorDacl

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW

iphlpapi

GetAdaptersAddresses
CancelMibChangeNotify2
NotifyAddrChange
NotifyIpInterfaceChange

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetEnvironmentStringsW
GetCommandLineA
FreeEnvironmentStringsW
SetStdHandle

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

ext-ms-win-networking-wlanapi-l1-1-0

WlanCloseHandle
WlanFreeMemory
WlanOpenHandle
WlanEnumInterfaces
WlanQueryInterface

wlanapi

WlanRegisterNotification

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW

api-ms-win-service-management-l1-1-0

StartServiceW
OpenSCManagerW
CloseServiceHandle
DeleteService
OpenServiceW
CreateServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW
GetOEMCP
GetUserDefaultLCID
LCMapStringW
EnumSystemLocalesW
IsValidLocale
IsValidCodePage
GetACP

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegCreateKeyW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
GetConsoleMode
WriteConsoleW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW
LookupAccountNameW

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_Status
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW

api-ms-win-mm-time-l1-1-0

timeEndPeriod
timeBeginPeriod

oleaut32

SysAllocString
VariantInit
SysFreeString

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

dnsapi

DnsServiceBrowse
DnsServiceRegister
DnsServiceDeRegister
DnsServiceBrowseCancel
DnsFree
DnsServiceFreeInstance

api-ms-win-core-namedpipe-l1-1-0

DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW

rpcrt4

RpcServerInqCallAttributesW
RpcServerUseProtseqEpW
RpcServerRegisterIf3
NdrServerCall2
NdrServerCallAll
RpcBindingVectorFree
RpcServerInqBindings
RpcEpRegisterW
RpcServerListen
RpcEpUnregister
RpcServerUnregisterIf
RpcMgmtWaitServerListen
RpcMgmtStopServerListening

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-oobe-notification-l1-1-0

RegisterWaitUntilOOBECompleted
UnregisterWaitUntilOOBECompleted

mfplat

MFShutdown
MFStartup

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW

api-ms-win-security-lsalookup-ansi-l2-1-0

LookupAccountNameA

user32

LoadCursorW
FindWindowW
SendMessageTimeoutW
LoadIconW
wsprintfW
DefWindowProcW
PostQuitMessage
wsprintfA
CreateWindowExW
GetMessageW
RegisterClassExW
TranslateMessage
PostMessageW
DispatchMessageW

shell32

ShellExecuteExW
ShellExecuteW

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

ole32

CoInitialize

msdmo

MoFreeMediaType
MoInitMediaType

kernel32

QueryPerformanceFrequency
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
TryEnterCriticalSection
TryAcquireSRWLockExclusive
EncodePointer
GetSystemTimePreciseAsFileTime
GetStringTypeW
CompareStringEx
GetCPInfo
__C_specific_handler
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
WaitForSingleObjectEx
AcquireSRWLockExclusive
SleepConditionVariableCS
LCMapStringEx
ReleaseSRWLockExclusive
InitializeSRWLock
WakeAllConditionVariable
GetCurrentThreadId
GetLocaleInfoEx

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlPcToFileHeader

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsGetValue
FlsFree
FlsAlloc

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

Sections

.text
Size: 991KB - Virtual size: 991KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a3eeb6629453ddfeeeea62fd47af943d

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-mm-mme-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-com-l1-1-0

ws2_32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

bcrypt

api-ms-win-core-heap-l1-1-0

crypt32

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-0

iphlpapi

api-ms-win-core-file-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

api-ms-win-core-registry-l1-1-1

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-mm-time-l1-1-0

oleaut32

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-processthreads-l1-1-1

dnsapi

api-ms-win-core-namedpipe-l1-1-0

rpcrt4

api-ms-win-security-base-l1-2-2

api-ms-win-security-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-oobe-notification-l1-1-0

mfplat

api-ms-win-power-setting-l1-1-0

api-ms-win-power-base-l1-1-0

userenv

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-security-lsalookup-ansi-l2-1-0

user32

shell32

advapi32

wtsapi32

ole32

msdmo

kernel32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

.text
Size: 991KB - Virtual size: 991KB

.rdata
Size: 420KB - Virtual size: 420KB

.data
Size: 14KB - Virtual size: 22KB

.pdata
Size: 34KB - Virtual size: 34KB

_RDATA
Size: 512B - Virtual size: 384B

.rsrc
Size: 105KB - Virtual size: 105KB

.reloc
Size: 572KB - Virtual size: 576KB