64368a5ad70678f19b53f1eae4b2602dd5c063ca1277dcd08e16dd31c9705e5b

Sharing

Copy URL Twitter E-mail

General

Target

64368a5ad70678f19b53f1eae4b2602dd5c063ca1277dcd08e16dd31c9705e5b
Size

5.4MB
MD5

8651551863307d7b769ff27c073eeb8f
SHA1

0913415f5f891d20e6781080723cac258c72b918
SHA256

64368a5ad70678f19b53f1eae4b2602dd5c063ca1277dcd08e16dd31c9705e5b
SHA512

8133b772257741c1c9b10d47279cdf764a801a199f4982f66aed088472ec171c7a496448543df66045354b223263b4c6554727ccffa0e662f7cdf9d07515df66
SSDEEP

49152:arFBJMYCn7EB0ADkVwAsOWvGJ1/Vif0zUzF5GtlqwPvIU6ia/XoaYXDCqOMZmsdL:aBNCxAHOI5h3+a/SOMZmtX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64368a5ad70678f19b53f1eae4b2602dd5c063ca1277dcd08e16dd31c9705e5b

Files

64368a5ad70678f19b53f1eae4b2602dd5c063ca1277dcd08e16dd31c9705e5b
.exe windows:4 windows x64

ec73b857ffd91773cc1857c1c8aa125b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

DeregisterEventSource
GetUserNameA
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegisterEventSourceW
ReportEventW

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetBitmapBits
SelectObject

iphlpapi

GetAdaptersAddresses

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
ConvertFiberToThread
ConvertThreadToFiberEx
CopyFileA
CreateDirectoryA
CreateFiberEx
CreateProcessA
CreateSemaphoreW
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
DeleteFileA
EnterCriticalSection
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FormatMessageW
FreeLibrary
GetACP
GetConsoleMode
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExA
GetEnvironmentVariableW
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
GetVersion
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
InitializeCriticalSection
InitializeSRWLock
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
RaiseException
ReadConsoleA
ReadConsoleW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryA
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleMode
SetFileAttributesA
SetLastError
SetUnhandledExceptionFilter
Sleep
SwitchToFiber
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
Wow64DisableWow64FsRedirection
WriteFile
lstrlenW

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_access
_acmdln
_amsg_exit
_cexit
_errno
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_findfirst64
_fileno
_findnext64
_fmode
_fstat64
_fullpath
_gmtime64
_initterm
_lseeki64
_mkdir
_onexit
_pclose
_popen
_read
_setmode
_snwprintf
_stat64
_strdup
_strdup
_strnicmp
_time64
_vsnprintf
_vsnwprintf
_wfopen
_wgetcwd
_time64
_wpopen
_write
_write
abort
atoi
calloc
ctime
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fgetws
fopen
fprintf
fputc
fputs
fputwc
fread
free
fseek
fsetpos
ftell
fwprintf
fwprintf
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
qsort
raise
rand
realloc
setlocale
setvbuf
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
vswprintf_s
wcscoll
wcscpy
wcsftime
wcslen
wcsstr
wcstombs
wcsxfrm

shlwapi

PathFindExtensionW
PathFindFileNameA
PathFindFileNameW

user32

CloseClipboard
GetClipboardData
GetDC
GetDesktopWindow
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowRect
MessageBoxA
MessageBoxW
OpenClipboard
ReleaseDC
ShowWindow

ws2_32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
shutdown
socket

sqlite3

sqlite3_close
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_text
sqlite3_finalize
sqlite3_open
sqlite3_prepare_v2
sqlite3_step

libcurl-x64

curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_formadd
curl_formfree
curl_global_cleanup
curl_global_init
curl_mime_addpart
curl_mime_filedata
curl_mime_free
curl_mime_init
curl_mime_name
curl_slist_append
curl_slist_free_all

libsodium-23

sodium_base642bin

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 727KB - Virtual size: 726KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ec73b857ffd91773cc1857c1c8aa125b

Headers

File Characteristics

Imports

advapi32

bcrypt

crypt32

gdi32

iphlpapi

kernel32

msvcrt

shlwapi

user32

ws2_32

sqlite3

libcurl-x64

libsodium-23

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.data Size: 26KB - Virtual size: 26KB

.rdata Size: 727KB - Virtual size: 726KB

.pdata Size: 176KB - Virtual size: 176KB

.xdata Size: 226KB - Virtual size: 225KB

.bss Size: - Virtual size: 15KB

.idata Size: 11KB - Virtual size: 11KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.text
Size: 4.2MB - Virtual size: 4.2MB

.data
Size: 26KB - Virtual size: 26KB

.rdata
Size: 727KB - Virtual size: 726KB

.pdata
Size: 176KB - Virtual size: 176KB

.xdata
Size: 226KB - Virtual size: 225KB

.bss
Size: - Virtual size: 15KB

.idata
Size: 11KB - Virtual size: 11KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B