dfdc6131de829a2554bbabb9fc6c7800_console[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dfdc6131de829a2554bbabb9fc6c7800_console.exe
Size

78KB
MD5

dfdc6131de829a2554bbabb9fc6c7800
SHA1

57a1796caa302d39c36905ad9292f6a3f1ea4d8f
SHA256

e288c0130c18cb90e4f1dccd1c742e2441d1f2b35ad9c917a51d511a08f1f8e8
SHA512

8a87359516102260d6b82a0cc254bb47dfe631b6d32cb30e262fdb8c0450045f9786aa3d99653445865dd042be6a18ecf7824354aae62c3e8526cd4fba7e42f2
SSDEEP

1536:OlmAN3EqfQf30I9Kchx8Ixf/a4q09KX096XPBzaw08tCze:OlmAN3E4Q/0I9thxTXa4q09KbfB2wTtR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfdc6131de829a2554bbabb9fc6c7800_console.exe

Files

dfdc6131de829a2554bbabb9fc6c7800_console.exe
.exe windows:6 windows x64

08b5d7d195211fe1cc97ad555c7d5bab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcpy
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
_cexit
_exit
wcschr
_wcsicmp
fwprintf
fgetpos
fflush
_fileno
_setmode
_get_osfhandle
_write
_vsnprintf_s
__set_app_type
__wgetmainargs
_amsg_exit
toupper
_XcptFilter
exit
setlocale
_vsnwprintf
_iob
__setusermatherr
memset

api-ms-win-core-libraryloader-l1-1-1

GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleHandleW

iphlpapi

ConvertInterfaceIndexToLuid
GetAdaptersAddresses
ConvertInterfaceLuidToNameW
ConvertLengthToIpv4Mask
GetNetworkParams
GetCurrentThreadCompartmentId
ConvertGuidToStringW
ConvertInterfaceLuidToGuid
SetCurrentThreadCompartmentId

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-core-sysinfo-l1-2-0

GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadUILanguage

ws2_32

InetNtopW
inet_ntoa

api-ms-win-core-file-l1-2-0

GetFileType
FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-1

GetDateFormatW
GetTimeFormatW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

dnsapi

DnsFreeConfigStructure
DnsQueryConfigAllocEx
DnsGetCacheDataTable
DnsFree
DnsQuery_W
DnsResolverOp
DnsFlushResolverCache

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapAlloc
HeapFree
HeapSetInformation

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
MultiByteToWideChar

api-ms-win-core-console-l1-1-0

GetConsoleMode

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

api-ms-win-core-synch-l1-2-0

ReleaseMutex
Sleep
WaitForSingleObject

api-ms-win-core-rtlsupport-l1-2-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

dhcpcsvc

DhcpReleaseParameters
DhcpAcquireParameters
DhcpEnumClasses
DhcpHandlePnPEvent

nsi

NsiAllocateAndGetTable
NsiSetAllParameters
NsiGetAllParameters
NsiFreeTable

dhcpcsvc6

Dhcpv6ReleaseParameters
Dhcpv6AcquireParameters
Dhcpv6IsEnabled
Dhcpv6GetUserClasses
Dhcpv6SetUserClass

ntdll

RtlIpv6AddressToStringA
RtlIpv6AddressToStringW
EtwTraceMessage
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlFreeUnicodeString
RtlStringFromGUID

api-ms-win-security-base-l1-2-0

CheckTokenMembership
FreeSid
AllocateAndInitializeSid

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08b5d7d195211fe1cc97ad555c7d5bab

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-1-1

iphlpapi

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

ws2_32

api-ms-win-core-file-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

dnsapi

api-ms-win-core-heap-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

dhcpcsvc

nsi

dhcpcsvc6

ntdll

api-ms-win-security-base-l1-2-0

Sections

.text Size: 53KB - Virtual size: 53KB

.data Size: 12KB - Virtual size: 13KB

.pdata Size: 1KB - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 53KB - Virtual size: 53KB

.data
Size: 12KB - Virtual size: 13KB

.pdata
Size: 1KB - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB