97ac96d6a300a5fbd1e20778c1a6203e78b787ea5364b708a9d0fd9b80b3c489

Sharing

Copy URL Twitter E-mail

General

Target

97ac96d6a300a5fbd1e20778c1a6203e78b787ea5364b708a9d0fd9b80b3c489
Size

6.7MB
MD5

c0a15218b5d16dd09d289114386128a3
SHA1

d5910afeed43cbedf2f45712cf054b12034a69e5
SHA256

97ac96d6a300a5fbd1e20778c1a6203e78b787ea5364b708a9d0fd9b80b3c489
SHA512

357a29dda470358569520e65c58f2dd8da8d1fdc17432d6268aa51cf3cf9ae5f119a499bbbdf3b0df0000456e183ebe6ea33c4cec67a33f9a8294d96544bf2bb
SSDEEP

49152:l/7A90i6P8+Hfdxy/ByXNtgsm1yrVw1Tumx7RxK9DdMWKMdLznBWPp4eegpS5hRw:9MZ1yrGorDA3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97ac96d6a300a5fbd1e20778c1a6203e78b787ea5364b708a9d0fd9b80b3c489

Files

97ac96d6a300a5fbd1e20778c1a6203e78b787ea5364b708a9d0fd9b80b3c489
.exe windows:6 windows x64

814a607058e72a593d7669fd34d142c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlUnwindEx
RtlVirtualUnwind
RtlCaptureContext
VerSetConditionMask
RtlPcToFileHeader
NtOpenProcessToken
NtClose
NtCreateMutant
RtlLookupFunctionEntry
RtlUnwind

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

advapi32

CryptCreateHash
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptGetHashParam
CryptAcquireContextA
LookupPrivilegeValueA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
AdjustTokenPrivileges

kernel32

SetLastError
FormatMessageW
GetTickCount
InitializeCriticalSectionEx
GetSystemDirectoryA
Sleep
MoveFileExA
CloseHandle
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
HeapQueryInformation
HeapReAlloc
GetCurrentThread
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GetLastError
ReadConsoleW
GetCommandLineW
GetCommandLineA
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetConsoleMode
GetConsoleOutputCP
WriteFile
DeleteFileW
GetTimeZoneInformation
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
GetSystemInfo
HeapValidate
HeapSize
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LoadLibraryExW
GetModuleFileNameW
InterlockedFlushSList
InterlockedPushEntrySList
GetStringTypeW
GetLocaleInfoEx
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
CloseThreadpoolWait
SetThreadpoolWait
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleW
GetStdHandle
DeleteCriticalSection
OutputDebugStringW
LeaveCriticalSection
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
CreateDirectoryExW
DeviceIoControl
AreFileApisANSI
GetTempPathW
SetFileTime
SetFilePointerEx
SetFileInformationByHandle
SetFileAttributesW
SetEndOfFile
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileExW
FindClose
CreateFileW
InitializeCriticalSection
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
FormatMessageA
LocalFree
TryEnterCriticalSection
InitializeSRWLock
FreeEnvironmentStringsW
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetSystemTimeAsFileTime
RaiseException
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
ResetEvent
SetEvent
MoveFileW
GetCurrentThreadId
GetLocaleInfoA
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
CreateThreadpoolWait
InitializeCriticalSectionAndSpinCount

user32

DispatchMessageW
TranslateMessage
GetDesktopWindow
MessageBeep
GetWindowRect
SetProcessDPIAware
EnumDisplayMonitors
UpdateWindow
MonitorFromWindow
LoadCursorW
SetWindowLongPtrW
SetWindowLongW
GetWindowLongW
WindowFromPoint
ScreenToClient
GetWindow
PostQuitMessage
GetMonitorInfoW
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetKeyboardLayout
TrackMouseEvent
GetMessageExtraInfo
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
IsChild
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
SetWindowPos
IsIconic
BringWindowToTop
SetFocus
GetKeyState
GetCapture
SetCapture
ReleaseCapture
IsWindowUnicode
GetForegroundWindow
SetForegroundWindow
GetDC
ReleaseDC
SetWindowTextW
GetClientRect
AdjustWindowRectEx
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
PeekMessageW

gdi32

DeleteObject
GetDeviceCaps
CreateRectRgn

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow

dwmapi

DwmGetColorizationColor
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled

bcrypt

BCryptGenRandom

ws2_32

WSAIoctl
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
gethostname
ioctlsocket
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
setsockopt
getsockname
htons
socket
__WSAFDIsSet
select
accept
bind
connect
getpeername

normaliz

IdnToAscii
IdnToUnicode

wldap32

ord46
ord211
ord60
ord45
ord50
ord41
ord217
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord301
ord30
ord200
ord143

crypt32

CertAddCertificateContextToStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertOpenStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore

Sections

.textbss
Size: - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 271KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 546B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

814a607058e72a593d7669fd34d142c9

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

d3d11

d3dcompiler_43

advapi32

kernel32

user32

gdi32

imm32

dwmapi

bcrypt

ws2_32

normaliz

wldap32

crypt32

Sections

.textbss Size: - Virtual size: 2.4MB

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 271KB - Virtual size: 324KB

.pdata Size: 200KB - Virtual size: 199KB

.idata Size: 16KB - Virtual size: 15KB

.msvcjmc Size: 1KB - Virtual size: 1KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 337B

_RDATA Size: 1024B - Virtual size: 546B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 42KB - Virtual size: 41KB

.textbss
Size: - Virtual size: 2.4MB

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 271KB - Virtual size: 324KB

.pdata
Size: 200KB - Virtual size: 199KB

.idata
Size: 16KB - Virtual size: 15KB

.msvcjmc
Size: 1KB - Virtual size: 1KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 337B

_RDATA
Size: 1024B - Virtual size: 546B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 42KB - Virtual size: 41KB