library_x64 (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

library_x64 (1).exe
Size

422KB
MD5

6d318b0b358aec4a41bdc5826d684d16
SHA1

a4d5ac8a6885f136273092185b095eca010f160f
SHA256

4736892579a463c3251aa89efa7eace4e5fe9c3f793fd634a0a72d5e2cdbebfd
SHA512

5b72a2b50f12d4a087f5333a0253056530faa62852ea079ca7218cf1b51b9052fff1df54677d72e7db36ff1001636c210da38453e58f425500b42d45154aa0fa
SSDEEP

6144:V9/NdIvhQv07UJntjwrFYb/Qs5lkoHDXP3nD53d2ZzM59yRVYwWeZ/k:Ll00WMntj8F9s5lXHrDXs8AowWet

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
library_x64 (1).exe

Files

library_x64 (1).exe
.exe windows:6 windows x64

fc1abdfd4f24771cda04255619333e1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcessId
OutputDebugStringW
IsDebuggerPresent
WideCharToMultiByte
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
MultiByteToWideChar
WaitForSingleObjectEx
MoveFileExA
Sleep
GetTickCount
QueryPerformanceCounter
VerifyVersionInfoA
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
VerSetConditionMask
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
GetModuleHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError

advapi32

CryptEncrypt
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
RegQueryValueExW
RegOpenKeyExW
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
RegCloseKey
CryptAcquireContextA

msvcp140

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

normaliz

IdnToAscii

wldap32

ord200
ord30
ord79
ord35
ord33
ord32
ord301
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord27
ord143

crypt32

CertFindExtension
CryptQueryObject
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore

ws2_32

__WSAFDIsSet
freeaddrinfo
WSAGetLastError
recvfrom
bind
connect
getpeername
getsockname
sendto
send
getsockopt
htons
getaddrinfo
ntohs
setsockopt
gethostname
select
socket
WSASetLastError
ntohl
WSAIoctl
WSAStartup
closesocket
WSACleanup
accept
recv
ioctlsocket
htonl
listen

vcruntime140

memset
strchr
strrchr
memchr
memmove
__current_exception
__current_exception_context
_CxxThrowException
__std_exception_destroy
memcpy
__C_specific_handler
__std_exception_copy
__std_terminate
strstr
memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_c_exit
terminate
__p___argv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
exit
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
_errno
_getpid
_invalid_parameter_noinfo_noreturn
_beginthreadex
__sys_nerr
strerror
system

api-ms-win-crt-heap-l1-1-0

calloc
free
_callnewh
realloc
malloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

fread
fputc
fflush
fclose
__acrt_iob_func
fwrite
__stdio_common_vfprintf
fopen
fputs
_open
_close
_write
_read
__stdio_common_vsscanf
__p__commode
_set_fmode
feof
fseek
ftell
_lseeki64
__stdio_common_vsprintf
fgets

api-ms-win-crt-filesystem-l1-1-0

_access
_unlink
_fstat64
_stat64

api-ms-win-crt-convert-l1-1-0

strtoul
strtoll
strtol
atoi

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

api-ms-win-crt-string-l1-1-0

strcmp
strpbrk
tolower
strcspn
strspn
isupper
_strdup
strncpy
strncmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc1abdfd4f24771cda04255619333e1a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp140

normaliz

wldap32

crypt32

ws2_32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 323KB - Virtual size: 322KB

.rdata Size: 82KB - Virtual size: 81KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 14KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 323KB - Virtual size: 322KB

.rdata
Size: 82KB - Virtual size: 81KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB