465fec269771e62016d41dd3860610c2d1e4cd6206e47d1d3fbc80399406db0b

Sharing

Copy URL Twitter E-mail

General

Target

465fec269771e62016d41dd3860610c2d1e4cd6206e47d1d3fbc80399406db0b
Size

1.3MB
MD5

44291da7a8746044d1ee281e7119511c
SHA1

6b7fbfce00e5e4c4dacc775d4b5cec09a95acaac
SHA256

465fec269771e62016d41dd3860610c2d1e4cd6206e47d1d3fbc80399406db0b
SHA512

4f066999193258bf84a17fe1f11bcf0726e869a370d32e56a3e90fdf47045d73ed92c597fad71dd8afbbc6dd87f56531c35fa0dc0e2039604553f1103c65d1e8
SSDEEP

24576:poNnRdRvdewpF+vJOgyHuUXz5dI4/u5JvxBAf2Qn652wOOU:pURvFeoVHuCdh/u5Jv09y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
465fec269771e62016d41dd3860610c2d1e4cd6206e47d1d3fbc80399406db0b

Files

465fec269771e62016d41dd3860610c2d1e4cd6206e47d1d3fbc80399406db0b
.exe windows:6 windows x64

d9197dc45ab3c6a6e93860f7405a3ca0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
SystemFunction036
RegCloseKey
RegQueryValueExW

kernel32

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
SwitchToThread
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetLastError
CloseHandle
TryAcquireSRWLockExclusive
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
WakeAllConditionVariable
SetHandleInformation
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
CreateFileW
GetFullPathNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateNamedPipeW
CreateThread
SetThreadStackGuarantee
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
GetOverlappedResult
ReadFile
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
WakeConditionVariable
PostQueuedCompletionStatus
AddVectoredExceptionHandler
WaitForMultipleObjects
GetExitCodeProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent

ntdll

NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateFile
NtWriteFile
NtReadFile
RtlNtStatusToDosError

ws2_32

connect
getaddrinfo
freeaddrinfo
shutdown
WSACleanup
recv
send
WSASend
bind
getsockopt
getpeername
WSAIoctl
setsockopt
ioctlsocket
WSAGetLastError
WSASocketW
getsockname
WSAStartup
closesocket

secur32

FreeContextBuffer
QueryContextAttributesW
ApplyControlToken
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleA
DeleteSecurityContext
EncryptMessage
DecryptMessage

crypt32

CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertDuplicateStore
CertAddCertificateContextToStore
CertCloseStore
CertEnumCertificatesInStore

bcrypt

BCryptGenRandom

vcruntime140

memcpy
memmove
memset
__C_specific_handler
__current_exception
__current_exception_context
memcmp
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_seh_filter_exe
_set_app_type
terminate
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 764KB - Virtual size: 764KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9197dc45ab3c6a6e93860f7405a3ca0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ws2_32

secur32

crypt32

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 764KB - Virtual size: 764KB

.rdata Size: 549KB - Virtual size: 549KB

.data Size: 512B - Virtual size: 792B

.pdata Size: 28KB - Virtual size: 28KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 764KB - Virtual size: 764KB

.rdata
Size: 549KB - Virtual size: 549KB

.data
Size: 512B - Virtual size: 792B

.pdata
Size: 28KB - Virtual size: 28KB

.reloc
Size: 7KB - Virtual size: 7KB