c69a9bb61d17382273c0de68df4db040_exe64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c69a9bb61d17382273c0de68df4db040_exe64.exe
Size

1.2MB
MD5

c69a9bb61d17382273c0de68df4db040
SHA1

7119f733dd9cafff8357d12cdadbfa3eae452da7
SHA256

4fb2ba3f59514ec882c3222cdc88a7c1566416e0df75cd6298202b9bd51ed7f1
SHA512

7be4140d408653cccd5c9b9dc412cd2c0f670b33eb4da1f795aab53880301abea9f4605af605ad3b052a215ab255a3f83d1d724f2ad33dcdbae2aeb099d257d9
SSDEEP

24576:HGne32ZEIOLMCldIgbXRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:FGZizdIgbXm+brLC2hTR9quLB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c69a9bb61d17382273c0de68df4db040_exe64.exe

Files

c69a9bb61d17382273c0de68df4db040_exe64.exe
.exe windows:6 windows x64

fc5175d5fb7babac96aa09ff83a51a07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
CreateServiceW
ChangeServiceConfig2W
ControlService
DeleteService
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
GetAce
GetAclInformation
InitializeAcl
GetLengthSid
IsValidSid
LookupAccountNameW
CreateWellKnownSid
RegGetValueW
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
RegEnumValueW
RegEnumKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetSecurityDescriptorGroup
GetTokenInformation
CopySid
LookupAccountSidW
SetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorDacl
OpenProcessToken

kernel32

LoadLibraryW
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
InitializeCriticalSection
SetEvent
Sleep
GetProfileIntW
SetPriorityClass
GetCurrentProcess
CreateEventW
ResetEvent
HeapSetInformation
GetCommandLineW
GetTempPathW
OutputDebugStringA
MoveFileExW
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetTickCount64
GetCurrentThreadId
QueueUserAPC
GetCurrentThread
SleepEx
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
DuplicateHandle
CreateThread
CreateWaitableTimerW
CancelWaitableTimer
CreateDirectoryW
SetWaitableTimer
WaitForSingleObject
GetExitCodeThread
K32GetModuleBaseNameW
GetCurrentProcessId
HeapReAlloc
OutputDebugStringW
WaitForMultipleObjects
ExitThread
GetFileAttributesW
SetFileAttributesW
OpenThread
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
WaitForMultipleObjectsEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetThreadExecutionState
GetLocalTime
lstrlenA
GetLastError
lstrlenW
FreeLibrary
RaiseException
DeleteCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
CloseHandle
GetVersionExA
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
EncodeSystemPointer
DecodeSystemPointer

user32

TranslateMessage
PostThreadMessageW
SetTimer
KillTimer
UnregisterDeviceNotification
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
RegisterDeviceNotificationW
CharNextW
LoadStringW
UnregisterClassA

msvcrt

_resetstkoflw
_purecall
_onexit
_wfopen
_wcsnicmp
_ui64tow
wcscat_s
memcpy_s
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
calloc
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
__CxxFrameHandler3
_callnewh
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
__C_specific_handler
memset
_localtime64
wcsftime
_time64
wcscspn
_wcsicmp
realloc
_errno
??1type_info@@UEAA@XZ
memcpy
fputws
_amsg_exit
fflush
wcstok_s
??0exception@@QEAA@XZ
memmove_s
free
malloc
wcsncpy_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
wcsstr
_itow_s
wcsncmp
swprintf_s
_vsnwprintf
wcschr
fclose
iswalpha
wcscpy_s
floor

ole32

CoTaskMemFree
CoRevertToSelf
CoImpersonateClient
CoFreeUnusedLibrariesEx
CLSIDFromString
CoWaitForMultipleHandles
StringFromCLSID
CoCreateGuid
CoDisconnectObject
CoInitialize
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
CoInitializeEx
CoSuspendClassObjects
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity

oleaut32

SysAllocStringByteLen
VarUI4FromStr
SysStringLen
SysAllocString
VariantInit
VariantClear
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayCreate
DispCallFunc
SafeArrayRedim
VarBstrCat
SysFreeString
SysStringByteLen
VarBstrCmp
SafeArrayDestroy

shlwapi

PathFileExistsW

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

ehtrace

ehTraceEvent
ehRegisterTraceGUIDs
ehFreeEventBuffer
ehUnregisterTraceGUIDs
ehAllocateEventBuffer

shell32

SHGetKnownFolderPath
SHCreateDirectoryExW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

slc

SLGetWindowsInformationDWORD

Exports

Exports

CETWProvider_Initialize
CETWProvider_TraceCriticalCall
CETWProvider_TraceEHomeEvent
CETWProvider_TraceErrorEvent
CETWProvider_TraceErrorLevel
CETWProvider_TraceEventID
CETWProvider_TraceInfo
CETWProvider_TracePerfMarkerEnd
CETWProvider_TracePerfMarkerStart
CETWProvider_TraceTextLevel
CETWProvider_TraceVideoSize
CETWProvider_Uninitialize

Sections

.text
Size: 326KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fc5175d5fb7babac96aa09ff83a51a07

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

shlwapi

version

ehtrace

shell32

ntdll

slc

Exports

Exports

Sections

.text Size: 326KB - Virtual size: 325KB

.rdata Size: 323KB - Virtual size: 322KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 326KB - Virtual size: 325KB

.rdata
Size: 323KB - Virtual size: 322KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 568KB - Virtual size: 572KB