d17b28d9d2m9od92[.]avi[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

d17b28d9d2m9od92.avi.exe
Size

4.7MB
MD5

24c5f4868dc5af255edbb993d98de51a
SHA1

9c806fe0d7d947e2f0a3389b949d46468f90cbb4
SHA256

deac11f26b14676e7fa98bff505360b8fef4f69183c336f5263bdefcf0bf797c
SHA512

abced7fd949b3fc489579ff374b1bdf9f369d859effe2296e3b56113e2977ff295db1703717aa6131cfac269f0cc971bafbe57a43e1ff74478cd8b6d6454ce48
SSDEEP

98304:mgme27SXUqRon5gyJHNuj+LhryFl1qqAIw1IpqTrdsR+:mgmeSSXUQon5gyHuj+LhryFl1qqAJqpv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d17b28d9d2m9od92.avi.exe

Files

d17b28d9d2m9od92.avi.exe
.dll regsvr32 windows:10 windows x64

6ac0494255f289fa08f5348c7771941f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

RtlCaptureContext

msvcrt

memcmp
qsort
isdigit
isalpha
_wcslwr_s
_wasctime_s
_vscwprintf
qsort_s
modf
_tzset
_ui64tow_s
_itow_s
_snwprintf_s
_beginthreadex
fwprintf
_flushall
fflush
fwprintf_s
atan
rand
srand
wcstok_s
wcsrchr
_wfsopen
_wsplitpath_s
acos
wcstoul
_stricmp
vswprintf_s
_i64tow_s
_wcsicmp
_localtime64_s
swprintf_s
_ltow
wcscat_s
_vsnwprintf_s
_ltow_s
_ultow_s
_controlfp_s
__C_specific_handler
_wcsnicmp
wcsncmp
wcsncpy_s
realloc
_wcsdup
wcschr
free
malloc
wcscpy_s
memmove_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
atan2
wcsstr
asin
cos
exp
log
sin
tan
strncmp
wcsncat_s
iswalpha
_callnewh
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
sqrt
wcscmp
_purecall
memcpy_s
_vsnwprintf
__iob_func
bsearch
_CxxThrowException
memmove
memset
tolower
__CxxFrameHandler3
sqrtf
fclose
ceil
floor
fmod
memcpy
pow

api-ms-win-downlevel-advapi32-l1-1-0

RegDeleteKeyExW
RegSetValueExW
EventRegister
RegCreateKeyExW
RegOpenKeyExW
EventWriteTransfer
EventWrite
RegQueryValueExW
RegGetValueW
EventUnregister
RegCloseKey

api-ms-win-downlevel-shlwapi-l1-1-0

PathGetDriveNumberW
PathIsUNCW
PathIsLFNFileSpecW
PathIsFileSpecW
PathFindFileNameW
StrTrimW
PathFileExistsW
StrCmpLogicalW
PathRemoveFileSpecW
StrCmpICW

api-ms-win-downlevel-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

kernel32

ResumeThread
LoadLibraryExA
GetProcessHeap
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
CreateFileW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SearchPathW
SleepConditionVariableSRW
WakeAllConditionVariable
SetUnhandledExceptionFilter
LocalFree
LocalAlloc
MultiByteToWideChar
FlushInstructionCache
ResetEvent
SetThreadStackGuarantee
GetSystemTimeAdjustment
QueryPerformanceFrequency
CompareStringEx
GetUserDefaultLocaleName
ResolveLocaleName
QueryThreadCycleTime
GetProcessIoCounters
Sleep
GetNumberFormatW
GetTimeFormatW
GetDateFormatW
GetSystemTime
LCMapStringW
CompareStringW
RtlVirtualUnwind
RtlLookupFunctionEntry
GetTimeZoneInformation
GetStringTypeW
SizeofResource
LockResource
LoadResource
FindResourceExW
UnhandledExceptionFilter
TerminateProcess
RtlAddFunctionTable
RtlDeleteFunctionTable
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
VirtualAlloc
VirtualFree
GlobalMemoryStatusEx
ResetWriteWatch
FreeLibraryAndExitThread
SetThreadPriority
WaitForMultipleObjectsEx
GetWriteWatch
GetCurrentThread
GetThreadContext
SetEvent
CreateEventW
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformationForYear
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
GetVersionExW
GetSystemInfo
EncodeSystemPointer
QueryPerformanceCounter
WerGetFlags
VirtualProtect
WerSetFlags
LoadLibraryExW
GetSystemDirectoryW
RaiseException
IsValidCodePage
GetLocaleInfoW
IsValidLocale
VirtualQuery
GetEnvironmentVariableW
GetACP
GetUserDefaultLCID
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetSystemTimeAsFileTime
InitOnceComplete
InitOnceBeginInitialize
RaiseFailFastException
DeleteAtom
TryEnterCriticalSection
FreeLibrary
AddAtomW
FindAtomW
InitializeCriticalSectionAndSpinCount
GetTickCount
InitializeCriticalSection
GetModuleFileNameW
GetCurrentProcess
K32GetModuleInformation
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
GetProcAddress
HeapAlloc
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
DelayLoadFailureHook

bcrypt

BCryptGenRandom

rpcrt4

CStdStubBuffer_QueryInterface
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_IsIIDSupported
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrDllUnregisterProxy
CStdStubBuffer_CountRefs
NdrDllCanUnloadNow
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
CStdStubBuffer_Disconnect
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy

advapi32

CryptReleaseContext

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JsAddRef
JsBoolToBoolean
JsBooleanToBool
JsCallFunction
JsCollectGarbage
JsConstructObject
JsConvertValueToBoolean
JsConvertValueToNumber
JsConvertValueToObject
JsConvertValueToString
JsCreateArray
JsCreateContext
JsCreateError
JsCreateExternalObject
JsCreateExternalType
JsCreateFunction
JsCreateObject
JsCreateRangeError
JsCreateReferenceError
JsCreateRuntime
JsCreateSyntaxError
JsCreateTypeError
JsCreateTypedExternalObject
JsCreateURIError
JsDefineProperty
JsDeleteIndexedProperty
JsDeleteProperty
JsDisableRuntimeExecution
JsDisposeRuntime
JsDoubleToNumber
JsEnableRuntimeExecution
JsEnumerateHeap
JsEquals
JsGetAndClearException
JsGetCurrentContext
JsGetDefaultTypeDescription
JsGetExtensionAllowed
JsGetExternalData
JsGetExternalType
JsGetFalseValue
JsGetGlobalObject
JsGetIndexedProperty
JsGetNullValue
JsGetOwnPropertyDescriptor
JsGetOwnPropertyNames
JsGetProperty
JsGetPropertyIdFromName
JsGetPropertyNameFromId
JsGetPrototype
JsGetRuntime
JsGetRuntimeMemoryLimit
JsGetRuntimeMemoryUsage
JsGetStringLength
JsGetTrueValue
JsGetUndefinedValue
JsGetValueType
JsHasException
JsHasExternalData
JsHasIndexedProperty
JsHasProperty
JsIdle
JsIntToNumber
JsIsEnumeratingHeap
JsIsRuntimeExecutionDisabled
JsNumberToDouble
JsParseScript
JsParseSerializedScript
JsPointerToString
JsPreventExtension
JsRelease
JsRunScript
JsRunSerializedScript
JsSerializeScript
JsSetCurrentContext
JsSetException
JsSetExternalData
JsSetIndexedProperty
JsSetProperty
JsSetPrototype
JsSetRuntimeBeforeCollectCallback
JsSetRuntimeMemoryAllocationCallback
JsSetRuntimeMemoryLimit
JsStartDebugging
JsStartProfiling
JsStopProfiling
JsStrictEquals
JsStringToPointer
JsValueToVariant
JsVarAddRef
JsVarRelease
JsVarToExtension
JsVarToScriptDirect
JsVariantToValue

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 929KB - Virtual size: 928KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ac0494255f289fa08f5348c7771941f

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

msvcrt

api-ms-win-downlevel-advapi32-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-0

api-ms-win-downlevel-version-l1-1-0

kernel32

bcrypt

rpcrt4

advapi32

Exports

Exports

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 929KB - Virtual size: 928KB

.data Size: 61KB - Virtual size: 79KB

.pdata Size: 236KB - Virtual size: 236KB

.didat Size: 512B - Virtual size: 400B

.rsrc Size: 88KB - Virtual size: 88KB

.reloc Size: 73KB - Virtual size: 73KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 929KB - Virtual size: 928KB

.data
Size: 61KB - Virtual size: 79KB

.pdata
Size: 236KB - Virtual size: 236KB

.didat
Size: 512B - Virtual size: 400B

.rsrc
Size: 88KB - Virtual size: 88KB

.reloc
Size: 73KB - Virtual size: 73KB