def2baa09a9ac50062c60679e808298d818ae89c0645198eacea38917fa485d9

Sharing

Copy URL Twitter E-mail

General

Target

def2baa09a9ac50062c60679e808298d818ae89c0645198eacea38917fa485d9
Size

381KB
MD5

07a07af89551078a8359377b49a6c133
SHA1

24dacacad7dfc45d24a236681b0f1e165819cd0a
SHA256

def2baa09a9ac50062c60679e808298d818ae89c0645198eacea38917fa485d9
SHA512

26e6a0a598e2f274ed1f3df9db573e2583289f187c527933fbc664e81fc3619f2753e1f6bb39b8c686cbb00d35157fedd123e93376173619664ffafb3df18c78
SSDEEP

6144:aka37Q2dwEhE+qFPb6mvas76UbhQX8NFIZeC:FEAvisRdfFe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
def2baa09a9ac50062c60679e808298d818ae89c0645198eacea38917fa485d9

Files

def2baa09a9ac50062c60679e808298d818ae89c0645198eacea38917fa485d9
.exe windows:6 windows x64

Password: infected

04e5a1543c686cbbf9c1e2adb65d395f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

kernel32

CreateRemoteThread
Process32FirstW
CloseHandle
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CreateToolhelp32Snapshot
GetCurrentProcessId
QueryPerformanceCounter
Sleep
WaitForSingleObject
Process32NextW
WriteProcessMemory
VirtualAllocEx
OpenProcess

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_crt_at_quick_exit
terminate
_invalid_parameter_noinfo_noreturn
system
abort
_cexit

vcruntime140

_CxxThrowException
__C_specific_handler
__current_exception
memcpy
memset
__std_exception_destroy
__std_exception_copy
memmove
__FrameUnwindFilter
__current_exception_context

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z

mscoree

_CorExeMain

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

04e5a1543c686cbbf9c1e2adb65d395f

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

api-ms-win-crt-runtime-l1-1-0

vcruntime140

msvcp140

mscoree

Sections

.text Size: 171KB - Virtual size: 170KB

.nep Size: 3KB - Virtual size: 2KB

.rdata Size: 201KB - Virtual size: 201KB

.data Size: 3KB - Virtual size: 3KB

.pdata Size: 512B - Virtual size: 480B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 92B

.text
Size: 171KB - Virtual size: 170KB

.nep
Size: 3KB - Virtual size: 2KB

.rdata
Size: 201KB - Virtual size: 201KB

.data
Size: 3KB - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 480B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 92B