1efe41c2ac6f2a80214803c43b7a1fc74e3235e7b358cfb5fcb8a9d439d7b850

Sharing

Copy URL Twitter E-mail

General

Target

1efe41c2ac6f2a80214803c43b7a1fc74e3235e7b358cfb5fcb8a9d439d7b850
Size

6.5MB
MD5

f9b890ecf272c876992c869df2c84606
SHA1

e3c2971d8e3d29ca8296916825a0de0418eff66d
SHA256

1efe41c2ac6f2a80214803c43b7a1fc74e3235e7b358cfb5fcb8a9d439d7b850
SHA512

e759eba3f94f320d15b8d3d43e2375eba32b7b6471525259b883249da20b620ebcfc813e40953fce072d0c3090cea8ba87f7267c9e40ab79edb9ff975335d3f2
SSDEEP

98304:Da4QvrEzX0HrtP4wtqmma8KrtDjPm8TylkLXLjy+Iq6+pCF5s2Pd+CifyBbbW:Da4OrEzXYh9PXylkmw6+y5s2F+vKp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1efe41c2ac6f2a80214803c43b7a1fc74e3235e7b358cfb5fcb8a9d439d7b850

Files

1efe41c2ac6f2a80214803c43b7a1fc74e3235e7b358cfb5fcb8a9d439d7b850
.exe windows:6 windows x64

77d036c5f2d02958995108997922084a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA

ws2_32

ioctlsocket
freeaddrinfo
closesocket
setsockopt
ntohl
shutdown
WSAGetLastError
htons
getaddrinfo
WSAStartup
send
socket
connect
select
WSAAddressToStringW
recv
getsockopt

iphlpapi

ConvertLengthToIpv4Mask
GetAdaptersAddresses

getopt

optind
optarg_a
getopt_long_a

libcrypto-3-x64

X509_free
PEM_read_bio_PrivateKey
EVP_PKEY_free
BIO_s_null
PEM_read_bio_X509
BIO_free
BIO_set_callback_ex
BIO_new_mem_buf
BIO_set_callback_arg
BIO_get_callback_arg
BIO_new
X509_sign
X509_set_serialNumber
PEM_write_bio_PrivateKey
ASN1_INTEGER_set
X509V3_EXT_cleanup
X509V3_set_ctx
BN_new
EVP_sha1
X509_set1_notAfter
ASN1_TIME_new
EVP_PKEY_assign
BIO_s_mem
ASN1_INTEGER_free
BN_set_word
BN_free
ASN1_TIME_set
X509_new
X509_add_ext
RSA_new
X509_set_pubkey
EVP_PKEY_new
ASN1_TIME_free
X509_set_version
PEM_write_bio_X509
X509V3_EXT_conf_nid
BIO_ctrl
ASN1_INTEGER_new
X509_EXTENSION_free
RSA_generate_key_ex
PEM_read_bio_RSAPublicKey
X509_set1_notBefore

libcurl

curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_easy_init

libssl-3-x64

SSL_set_verify
SSL_shutdown
SSL_CTX_set_security_level
SSL_set_shutdown
SSL_get_error
SSL_set_connect_state
SSL_read
SSL_CTX_use_certificate
SSL_do_handshake
TLS_method
SSL_free
SSL_CTX_set_options
SSL_new
SSL_CTX_free
SSL_CTX_ctrl
SSL_CTX_use_PrivateKey
SSL_CTX_new
SSL_write
SSL_set_bio

libusb-1.0

libusb_unref_device
libusb_free_device_list
libusb_get_device_descriptor
libusb_open
libusb_claim_interface
libusb_bulk_transfer
libusb_handle_events
libusb_get_device_list
libusb_init
libusb_exit
libusb_close
libusb_set_configuration
libusb_open_device_with_vid_pid
libusb_reset_device
libusb_alloc_transfer
libusb_submit_transfer
libusb_cancel_transfer
libusb_free_transfer
libusb_control_transfer
libusb_handle_events_timeout_completed
libusb_error_name

readline

readline
add_history
read_history
write_history

zip

zip_unchange_all
zip_close

mfc140u

ord2903
ord3726
ord4510
ord4511
ord12563
ord8409
ord5709
ord4181
ord1670
ord14030
ord14033
ord14039
ord12265
ord12442
ord1671
ord293
ord1667
ord290
ord12926
ord2416
ord12564
ord3727
ord310
ord300
ord265
ord1511
ord4656
ord8058
ord1489
ord1491
ord2346
ord2344
ord2350
ord4949
ord316
ord1034
ord4658
ord280
ord286
ord1033
ord962
ord12933
ord1428
ord266
ord1510
ord1678
ord4913
ord4947
ord2921
ord296
ord285
ord1501
ord1503
ord1504
ord14027

kernel32

GetCurrentDirectoryW
CreateDirectoryW
GetProcAddress
GetModuleHandleW
Process32FirstW
LoadLibraryW
CreateMutexW
GetCurrentProcess
CreateThread
GetModuleFileNameW
LoadResource
LockResource
GetFileAttributesA
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
Sleep
CloseHandle
OutputDebugStringW
WideCharToMultiByte
DeleteCriticalSection
GetTickCount
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
Process32NextW
HeapAlloc
HeapDestroy
GetLastError
RaiseException
FreeLibrary
GetProductInfo
SizeofResource
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetConsoleMode
SetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetOverlappedResult
CreateEventW
CancelIo
GetPrivateProfileStringA
FindClose
FindNextFileW
GetFullPathNameW
FindFirstFileExW
ExitProcess
CreateSemaphoreW
ReleaseSemaphore
LoadLibraryExA
GetDiskFreeSpaceA
VerifyVersionInfoA
GetSystemWow64DirectoryA
GetVersionExA
GetLocalTime
VerSetConditionMask
K32GetProcessImageFileNameW
K32GetModuleFileNameExW
QueryFullProcessImageNameW
GetModuleHandleA
IsWow64Process
ReadProcessMemory
GetNativeSystemInfo
GetFileType
DeleteVolumeMountPointA
SetVolumeMountPointA
FindNextVolumeA
FindFirstVolumeA
QueryDosDeviceA
GetLogicalDriveStringsA
GetTickCount64
GetLogicalDrives
CreateFileA
SetFilePointerEx
GetVolumeNameForVolumeMountPointA
FormatMessageW
GetStartupInfoA
CreateProcessA
GetCurrentProcessId
GetVolumeInformationA
DeleteFileA
GetCurrentDirectoryA
LoadLibraryA
GetEnvironmentVariableA
SetLastError
MoveFileW
GetPrivateProfileIntW
GetCurrentThreadId
SetFilePointer
GetFileSize
FlushFileBuffers
LocalFree
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
ExitThread
FindResourceExW
GetStartupInfoW
WaitForSingleObject
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetVolumeInformationW
GetDriveTypeW
GetDiskFreeSpaceExW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
DeleteFileW
CreateFileW
CreateProcessW
TerminateThread
InitializeCriticalSection
CreatePipe
DuplicateHandle
WriteFile
ReadFile
GetStdHandle
MultiByteToWideChar
CopyFileExW
WritePrivateProfileStringW
GetPrivateProfileStringW
FindResourceW

user32

SendMessageW
GetDC
ShowWindow
ReleaseDC
GetDesktopWindow
DispatchMessageW
TranslateMessage
GetSystemMetrics
EnumDisplaySettingsW
MonitorFromWindow
GetMonitorInfoW
GetMessageW

gdi32

GetDeviceCaps

advapi32

OpenServiceA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ChangeServiceConfigW
CloseServiceHandle
OpenSCManagerA
RegCreateKeyExW
QueryServiceStatusEx
StartServiceW
RegCloseKey
RegOpenKeyExW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

shlwapi

PathIsDirectoryW
StrCmpW

ole32

OleInitialize
OleUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoTaskMemFree
CoCreateGuid

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
VariantClear

msvcp140

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@HPEBD@Z
?_Xruntime_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

vcruntime140

__current_exception_context
__std_exception_destroy
_CxxThrowException
__std_exception_copy
__current_exception
memcpy
memmove
memset
strrchr
strchr
strstr
wcsrchr
_purecall
memcmp
wcsstr
__std_terminate
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_endthreadex
_seh_filter_exe
_errno
_set_app_type
_configure_wide_argv
_endthread
_invalid_parameter_noinfo
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
perror
_c_exit
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_wassert
_set_errno
_invalid_parameter_noinfo_noreturn
exit
_cexit
strerror
_beginthreadex

api-ms-win-crt-string-l1-1-0

isspace
strcpy_s
_stricmp
_strdup
wcsncpy
strncat
strncmp
strcmp
wmemcpy_s
strncpy
toupper
isxdigit
strnlen
wcscpy_s
_wcsicmp
wcsncmp
wcsncpy_s
isdigit
strtok
_strnicmp
strcat_s

api-ms-win-crt-heap-l1-1-0

realloc
calloc
free
malloc
_recalloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

_fileno
fputs
_isatty
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fread
_wfopen_s
fopen_s
rewind
fopen
_write
_open
puts
_get_osfhandle
__stdio_common_vswprintf_s
_set_fmode
__stdio_common_vsscanf
_close
__stdio_common_vfprintf
__stdio_common_vswprintf
fclose
__p__commode
_ftelli64
fwrite
ftell
__acrt_iob_func
_fseeki64
__stdio_common_vsnprintf_s
fseek
fflush
ferror

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_stat64i32
_mkdir
_access
_splitpath

api-ms-win-crt-convert-l1-1-0

_itow
wcstombs_s
_wtoi
strtol
strtoull
mbstowcs_s
atof

api-ms-win-crt-multibyte-l1-1-0

_mbsinc
_mbschr

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_time64
_localtime64

api-ms-win-crt-math-l1-1-0

_dclass
pow
ceil
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

buffer_read_from_filename
buffer_write_to_filename
cfprintf
collection_add
collection_copy
collection_count
collection_free
collection_init
collection_remove
cond_destroy
cond_init
cond_signal
cond_wait
cond_wait_timeout
cprintf
cvfprintf
diagnostics_relay_client_free
diagnostics_relay_client_new
diagnostics_relay_client_start_service
diagnostics_relay_goodbye
diagnostics_relay_query_ioregistry_entry
diagnostics_relay_query_ioregistry_plane
diagnostics_relay_query_mobilegestalt
diagnostics_relay_request_diagnostics
diagnostics_relay_restart
diagnostics_relay_shutdown
diagnostics_relay_sleep
dirname_must_free
generate_uuid
idevice_connect
idevice_connection_disable_bypass_ssl
idevice_connection_disable_ssl
idevice_connection_enable_ssl
idevice_connection_get_fd
idevice_connection_receive
idevice_connection_receive_timeout
idevice_connection_send
idevice_device_list_extended_free
idevice_device_list_free
idevice_disconnect
idevice_event_subscribe
idevice_event_unsubscribe
idevice_events_subscribe
idevice_events_unsubscribe
idevice_free
idevice_get_device_list
idevice_get_device_list_extended
idevice_get_handle
idevice_get_udid
idevice_new
idevice_new_with_options
idevice_set_debug_level
libusbmuxd_set_debug_level
libusbmuxd_set_use_inotify
lockdownd_activate
lockdownd_client_free
lockdownd_client_new
lockdownd_client_new_with_handshake
lockdownd_client_set_label
lockdownd_data_classes_free
lockdownd_deactivate
lockdownd_enter_recovery
lockdownd_get_device_name
lockdownd_get_device_udid
lockdownd_get_sync_data_classes
lockdownd_get_value
lockdownd_goodbye
lockdownd_pair
lockdownd_pair_with_options
lockdownd_query_type
lockdownd_receive
lockdownd_remove_value
lockdownd_send
lockdownd_service_descriptor_free
lockdownd_set_value
lockdownd_start_service
lockdownd_start_service_with_escrow_bag
lockdownd_start_session
lockdownd_stop_session
lockdownd_strerror
lockdownd_unpair
lockdownd_validate_pair
mutex_destroy
mutex_init
mutex_lock
mutex_unlock
pair_record_get_host_id
preboard_client_free
preboard_client_new
preboard_client_start_service
preboard_commit_stashbag
preboard_create_stashbag
preboard_receive
preboard_receive_with_timeout
preboard_send
property_list_service_client_free
property_list_service_client_new
property_list_service_disable_ssl
property_list_service_enable_ssl
property_list_service_get_service_client
property_list_service_receive_plist
property_list_service_receive_plist_with_timeout
property_list_service_send_binary_plist
property_list_service_send_xml_plist
restored_client_free
restored_client_new
restored_client_set_label
restored_get_value
restored_goodbye
restored_query_type
restored_query_value
restored_reboot
restored_receive
restored_send
restored_start_restore
service_client_factory_start_service
service_client_free
service_client_new
service_disable_bypass_ssl
service_disable_ssl
service_enable_ssl
service_get_connection
service_receive
service_receive_with_timeout
service_send
string_append
string_build_path
string_concat
string_format_size
string_toupper
term_colors_init
term_colors_set_enabled
thread_alive
thread_cancel
thread_detach
thread_free
thread_join
thread_new
thread_once
usbmuxd_connect
usbmuxd_delete_pair_record
usbmuxd_device_list_free
usbmuxd_disconnect
usbmuxd_events_subscribe
usbmuxd_events_unsubscribe
usbmuxd_get_device
usbmuxd_get_device_by_udid
usbmuxd_get_device_list
usbmuxd_read_buid
usbmuxd_read_pair_record
usbmuxd_recv
usbmuxd_recv_timeout
usbmuxd_save_pair_record
usbmuxd_save_pair_record_with_device_id
usbmuxd_send
usbmuxd_subscribe
usbmuxd_unsubscribe
userpref_get_paired_udids
userpref_read_pair_record
userpref_read_system_buid

Sections

.text
Size: 358KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 159KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 628KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77d036c5f2d02958995108997922084a

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

ws2_32

iphlpapi

getopt

libcrypto-3-x64

libcurl

libssl-3-x64

libusb-1.0

readline

zip

mfc140u

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

oleaut32

msvcp140

version

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 358KB - Virtual size: 357KB

.rdata Size: 5.4MB - Virtual size: 5.4MB

.data Size: 159KB - Virtual size: 302KB

.pdata Size: 18KB - Virtual size: 17KB

.rsrc Size: 628KB - Virtual size: 627KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 358KB - Virtual size: 357KB

.rdata
Size: 5.4MB - Virtual size: 5.4MB

.data
Size: 159KB - Virtual size: 302KB

.pdata
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 628KB - Virtual size: 627KB

.reloc
Size: 2KB - Virtual size: 2KB