eventcreate[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

eventcreate.exe
Size

39KB
MD5

e4b3425316e1b413523551e4ce50cf82
SHA1

768a4ba253bb904a3c31c93e8f5a9487941e3fa6
SHA256

95e14793fa57f97a8fc73f5860a070cdae667546a7a04c82b2b3dbae94d2da0c
SHA512

1d9857eaae9a075f21565461713b1b5ecb25c7fc466591f1560ce03f23d819075ae73ae8c36b3bb80df47d6aab980293fbb4a66f314d9c6f1c8622e965461277
SSDEEP

768:fYQZL2xNBX7CBM2sPO+gx5IJ2OP7bv07ZqyhHjIpHuY6I6xoMINw:fYQZgeBM2U6x5e/vOMHj6rxxINw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eventcreate.exe

Files

eventcreate.exe
.exe windows:6 windows x64

465546be0d70b3f23b522d5553f658b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegisterEventSourceW
OpenProcessToken
OpenEventLogW
GetTokenInformation
RegCreateKeyExW
RegQueryValueExW
DeregisterEventSource
RegConnectRegistryW
RegOpenKeyExW
ReportEventW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
CloseEventLog

kernel32

CloseHandle
GetModuleFileNameW
GetComputerNameExW
HeapSize
HeapReAlloc
HeapAlloc
HeapValidate
HeapFree
GetProcessHeap
ReadConsoleW
ReadFile
SetConsoleMode
MultiByteToWideChar
GetConsoleOutputCP
ExitProcess
WriteConsoleW
SetLastError
GetThreadLocale
CompareStringW
lstrlenW
lstrlenA
GetStdHandle
GetConsoleMode
GetFileType
WideCharToMultiByte
LocalFree
GetCurrentProcess
GetLastError
Sleep
SetUnhandledExceptionFilter
FormatMessageW
SetThreadUILanguage
TerminateProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
CompareStringA

msvcrt

wcstok
fflush
fprintf
__iob_func
_get_osfhandle
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_iob
_memicmp
_vsnwprintf
_errno
wcstod
wcstol
wcstoul
_fileno
memset

ntdll

RtlVirtualUnwind
VerSetConditionMask
RtlVerifyVersionInfo
RtlLookupFunctionEntry
RtlCaptureContext

user32

CharUpperW
LoadStringW

mpr

WNetGetLastErrorW
WNetAddConnection2W
WNetCancelConnection2W

secur32

GetUserNameExW

ws2_32

WSACleanup
GetAddrInfoW
GetNameInfoW
FreeAddrInfoW
WSAGetLastError
WSAStartup

netapi32

NetApiBufferFree
NetServerGetInfo

shlwapi

StrStrIW
StrChrW
StrChrIW
StrStrW

version

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

465546be0d70b3f23b522d5553f658b5

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

user32

mpr

secur32

ws2_32

netapi32

shlwapi

version

Sections

.text Size: 29KB - Virtual size: 28KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 36B

.text
Size: 29KB - Virtual size: 28KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 36B