7a8b11aa0e3840ea98e82142d98733d426b294f923926ee7ca711cfc9bb5b9a1

Sharing

Copy URL Twitter E-mail

General

Target

7a8b11aa0e3840ea98e82142d98733d426b294f923926ee7ca711cfc9bb5b9a1
Size

23KB
MD5

bd965c1e838b7303e474a834986a2734
SHA1

9373cb03323b8796e1ac750a87d0e3a2b1809cbe
SHA256

7a8b11aa0e3840ea98e82142d98733d426b294f923926ee7ca711cfc9bb5b9a1
SHA512

72476accab93e0f7ec06e37c4634be3d0de8ec107de91d40d7cbbd83802a2bb9dcadc9bd9a7ec3bc656615ae55cb5348ced666f7a3c9d5b7e9ebe7da62444c2c
SSDEEP

384:lpaoAY0X97XWBgb1EquN6rFibbuIrqfRHtN3/8rEM7XQkOYrRA89ntzTKKkolKBX:Tfjyb+PN6aqfd4AM7gkxA8ZtKKLk3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a8b11aa0e3840ea98e82142d98733d426b294f923926ee7ca711cfc9bb5b9a1

Files

7a8b11aa0e3840ea98e82142d98733d426b294f923926ee7ca711cfc9bb5b9a1
.exe windows:6 windows x86

adecd4722314fd061c497f93282e74fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WTSGetActiveConsoleSessionId
CreateThread
CloseHandle
Process32FirstW
SetEvent
Process32NextW
GetLastError
CreateEventW
CreateToolhelp32Snapshot
WaitForSingleObject
GetModuleFileNameW
GetCurrentProcess
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW

advapi32

OpenProcessToken
RegisterServiceCtrlHandlerExW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
ChangeServiceConfig2W
DeleteService
ControlService
StartServiceW
StartServiceCtrlDispatcherW
OpenServiceW
LookupPrivilegeValueW
DuplicateTokenEx
GetLengthSid
CreateProcessAsUserW
AllocateAndInitializeSid
SetTokenInformation
AdjustTokenPrivileges

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

vcruntime140

_except_handler4_common
__std_exception_copy
__std_terminate
memmove
__std_exception_destroy
memset
__CxxFrameHandler3
_CxxThrowException
memcpy

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_c_exit
_controlfp_s
terminate
exit
_cexit
__p___wargv
__p___argc
_invalid_parameter_noinfo_noreturn
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_crt_atexit
_set_app_type
_seh_filter_exe

api-ms-win-crt-string-l1-1-0

wcscat_s
_wcsicmp

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

adecd4722314fd061c497f93282e74fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

userenv

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 3KB

.gfids Size: 512B - Virtual size: 80B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 3KB

.gfids
Size: 512B - Virtual size: 80B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB