MPNWoker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MPNWoker.exe
Size

35KB
MD5

8a9b5108321c56e96c97a467ef178edc
SHA1

6c8148f78f5524e84f541510842819c53539d720
SHA256

f962daa621d21afcccb8e6aa839e6f8aaec36b2fd1ffa4e23904c632d1088e65
SHA512

b5a4dbe3862e005ce020d986e9f60ea0d3e9b5b783202b4e25f820839b29f59a75ead88c9c49a975981eebb8170d5a41a6bdf3419f4ace4856468ce850e8675e
SSDEEP

384:KKclaREVHiBXXAsFIl/AE75xwVuHFuEo9ZrIfL0nnZsmystHVLx2I3M4ESmb:KlaqNiWsC8U8ZTIT0nnZ7LBBxn39O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MPNWoker.exe

Files

MPNWoker.exe
.exe windows:6 windows x64

71de361a793ccb92ca7314c65ecfe06b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcAddress
LoadLibraryA
Sleep
ExitProcess
GetModuleFileNameA
GetCurrentDirectoryA
GetModuleHandleA
SetPriorityClass
SetThreadPriority
CreateFileA
WriteFile
CloseHandle
CreateMutexA
GetLastError
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
RtlCaptureContext
SetUnhandledExceptionFilter
GetCurrentProcess
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess

shell32

SHChangeNotify

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

ws2_32

inet_pton
inet_ntoa
htons
send
recv
closesocket
WSAStartup
WSACleanup
connect
gethostbyname
socket

shlwapi

PathStripPathA

wininet

InternetReadFile

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

vcruntime140

memcpy
memset
memmove
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_get_initial_narrow_environment
exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
__p__pgmptr
_exit
_invalid_parameter_noinfo_noreturn
_initterm

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vsprintf_s
__p__commode
_set_fmode
puts

api-ms-win-crt-string-l1-1-0

strcat_s

api-ms-win-crt-time-l1-1-0

_time64
_localtime64
_gmtime64
_mktime64

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
_callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71de361a793ccb92ca7314c65ecfe06b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

msvcp140

ws2_32

shlwapi

wininet

version

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 56B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 72B

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 56B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 72B