da409e1631f146662309dfeb0fac0b69a7d0a3e7622609ecb6c2f97d2fcbf8f3

Sharing

Copy URL Twitter E-mail

General

Target

da409e1631f146662309dfeb0fac0b69a7d0a3e7622609ecb6c2f97d2fcbf8f3
Size

1.4MB
MD5

cfd316b0f90fe01fe2defd365e2ffc8d
SHA1

8af1262a237ee14e5ea297a1ff8568d30bcaf7c3
SHA256

da409e1631f146662309dfeb0fac0b69a7d0a3e7622609ecb6c2f97d2fcbf8f3
SHA512

148c2f9533f5cad7cd84f06e3dac41f07bb775a02968fee19fd87bf6988c1c97c3298f2edf79c2a2cdc836c5db99b95350e38fd20d35500ff906c2e90e607e13
SSDEEP

24576:3Q8Ru7T4OJOsL5cgzP2oO3R6P+favG3AfqQn6520OOmGl:3Qt7MOJOsLCKeoyR0+fa+0Ri

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da409e1631f146662309dfeb0fac0b69a7d0a3e7622609ecb6c2f97d2fcbf8f3

Files

da409e1631f146662309dfeb0fac0b69a7d0a3e7622609ecb6c2f97d2fcbf8f3
.exe windows:6 windows x64

119843f3df6e9bc641406adaf6f636e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlVirtualUnwind
RtlCaptureContext
NtReadFile
NtCancelIoFileEx
NtWriteFile
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
RtlLookupFunctionEntry

kernel32

GetCurrentThreadId
CreateIoCompletionPort
WakeAllConditionVariable
SetFileCompletionNotificationModes
SetHandleInformation
GetSystemTimeAsFileTime
GetModuleHandleA
InitializeSListHead
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
CreateFileW
TryAcquireSRWLockExclusive
SetLastError
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetFinalPathNameByHandleW
CreateNamedPipeW
CreateThread
ReadFileEx
SwitchToThread
CreateEventW
CancelIo
GetOverlappedResult
ReadFile
WaitForMultipleObjects
GetExitCodeProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
WakeConditionVariable
AcquireSRWLockExclusive
HeapReAlloc
GetProcessHeap
PostQueuedCompletionStatus
HeapAlloc
SetThreadStackGuarantee
ReleaseSRWLockExclusive
GetQueuedCompletionStatusEx
AddVectoredExceptionHandler
GetLastError
GetFullPathNameW
WriteFileEx
SleepEx
GetTickCount64
GetDiskFreeSpaceExW
CloseHandle
HeapFree
GetProcAddress
IsProcessorFeaturePresent

ws2_32

connect
getaddrinfo
freeaddrinfo
WSAStartup
WSASend
recv
send
shutdown
bind
getsockopt
closesocket
WSAIoctl
setsockopt
ioctlsocket
WSASocketW
getsockname
WSAGetLastError
getpeername
WSACleanup

crypt32

CertDuplicateStore
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertCloseStore
CertFreeCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain

secur32

AcquireCredentialsHandleA
EncryptMessage
DeleteSecurityContext
ApplyControlToken
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
QueryContextAttributesW
DecryptMessage
FreeContextBuffer

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

bcrypt

BCryptGenRandom

vcruntime140

__current_exception
__current_exception_context
memcpy
memset
memmove
__CxxFrameHandler3
memcmp
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argv
__p___argc
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_set_app_type
_seh_filter_exe
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_initterm
terminate
_initterm_e
_cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 843KB - Virtual size: 842KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 561KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

119843f3df6e9bc641406adaf6f636e3

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

ws2_32

crypt32

secur32

advapi32

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 843KB - Virtual size: 842KB

.rdata Size: 561KB - Virtual size: 560KB

.data Size: 512B - Virtual size: 792B

.pdata Size: 24KB - Virtual size: 23KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 843KB - Virtual size: 842KB

.rdata
Size: 561KB - Virtual size: 560KB

.data
Size: 512B - Virtual size: 792B

.pdata
Size: 24KB - Virtual size: 23KB

.reloc
Size: 7KB - Virtual size: 7KB