142440671e56ba3b02a36aebb6f3b36fc42a0a29c6dc69e35f0d37bfad27315a

Sharing

Copy URL Twitter E-mail

General

Target

142440671e56ba3b02a36aebb6f3b36fc42a0a29c6dc69e35f0d37bfad27315a
Size

3.0MB
MD5

6138955a58e9d206f67bdc135dbf69d7
SHA1

66ff8b21ac75ed25f55159115eab6c1dbc8958a5
SHA256

142440671e56ba3b02a36aebb6f3b36fc42a0a29c6dc69e35f0d37bfad27315a
SHA512

ead1d7bf4fffd40fb68cfc54581fc4bb2ffa0f015855367a17b1e3e01eb7a5c3e0e4c2cbafe35c6bb09a7ad96135bbaeb0e201ee770b7cb7873f3a911adf38e7
SSDEEP

49152:BGtlqUnVwASOzfIU6iHToYIBx1AM8648wQG16SIJ2MDx5TKwjPwOgOCRFMOMAb:+w+oX83egqzcOgFRuA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
142440671e56ba3b02a36aebb6f3b36fc42a0a29c6dc69e35f0d37bfad27315a

Files

142440671e56ba3b02a36aebb6f3b36fc42a0a29c6dc69e35f0d37bfad27315a
.exe windows:6 windows x64

052da31c15b33c58ca673e17f8066956

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

kernel32

GetStartupInfoW
InitializeSListHead
VerSetConditionMask
GetStdHandle
FindClose
FindNextFileW
WriteFile
CloseHandle
GetLastError
SetLastError
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThread
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetSystemTime
GetPhysicallyInstalledSystemMemory
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
LoadLibraryA
LoadLibraryW
LocalFree
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
FormatMessageW
MoveFileExW
VerifyVersionInfoW
SystemTimeToFileTime
GetEnvironmentVariableA
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLocalTime
FormatMessageA
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionEx
SleepEx
WaitForSingleObjectEx
GetTickCount
GetSystemDirectoryW
GetModuleHandleExW
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
FindFirstFileW
GetFileType
RtlVirtualUnwind
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
RtlCaptureContext

msvcp140

_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

memcmp
memset
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
_purecall
__current_exception_context
__current_exception
memchr
__C_specific_handler
wcschr
strchr
strstr
strrchr
wcsstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_seh_filter_exe
_set_app_type
_errno
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
signal
_c_exit
_register_thread_local_exe_atexit_callback
raise
_exit
_invalid_parameter_noinfo_noreturn
strerror_s
terminate
_configure_narrow_argv
__sys_nerr
_cexit
strerror
_beginthreadex

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoull
strtoul
strtoll
strtol
strtod
atoi

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
calloc
realloc
malloc
_callnewh

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s
_makepath_s
_wstat64
_unlink
_waccess
_fstat64
_stat64i32
_fstat64i32

api-ms-win-crt-stdio-l1-1-0

_fileno
fgets
fflush
feof
fclose
fputc
fread
fseek
ftell
__stdio_common_vswprintf
__p__commode
_set_fmode
fwrite
setbuf
clearerr
_setmode
ferror
_lseeki64
_wopen
setvbuf
__stdio_common_vfprintf
_wfopen
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vsscanf
_read
_close
fopen
__acrt_iob_func
fputs
_write

api-ms-win-crt-string-l1-1-0

strcpy_s
_stricmp
_strdup
strncmp
wcspbrk
_strnicmp
_wcsdup
strcspn
strspn
strncpy
isspace
strcmp
tolower

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64_s
_time64
_gmtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

ole32

CoUninitialize

oleaut32

VariantClear

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW

ws2_32

send
setsockopt
WSAStartup
WSACleanup
WSAGetLastError
getaddrinfo
select
listen
connect
getsockname
ntohs
socket
accept
bind
closesocket
getpeername
getsockopt
WSASetLastError
ioctlsocket
htonl
freeaddrinfo
htons
recv
__WSAFDIsSet
WSACloseEvent
inet_pton
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAIoctl
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 628KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

052da31c15b33c58ca673e17f8066956

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

kernel32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

ole32

oleaut32

user32

ws2_32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 628KB - Virtual size: 628KB

.data Size: 30KB - Virtual size: 47KB

.pdata Size: 82KB - Virtual size: 82KB

_RDATA Size: 9KB - Virtual size: 8KB

.rsrc Size: 164KB - Virtual size: 164KB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 628KB - Virtual size: 628KB

.data
Size: 30KB - Virtual size: 47KB

.pdata
Size: 82KB - Virtual size: 82KB

_RDATA
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 164KB - Virtual size: 164KB

.reloc
Size: 23KB - Virtual size: 23KB