ce3f66b666b7ca05496c25b1f162711042d153357d9f77f43689a090916d5f0c

Sharing

Copy URL Twitter E-mail

General

Target

ce3f66b666b7ca05496c25b1f162711042d153357d9f77f43689a090916d5f0c
Size

1.7MB
MD5

a681cedfdf59dcd9e4d8f9a9816eb186
SHA1

47b5e7a5aa28cd8d32ae658999fe5aaed8c2f7c3
SHA256

ce3f66b666b7ca05496c25b1f162711042d153357d9f77f43689a090916d5f0c
SHA512

33e120c73470d28172109177e9f6aa94c68acbb1455be20cfebf6692beba838f4b04aae1e5f3d8eb4e35bb70ee4fa32a7e2c7d9fe27e754b0a10730e0f24ff9c
SSDEEP

49152:OspFMwcKBVeLluUSEWVIPNZILspfDyXSQqTNt3jWldD:MwcduUBhpfmXmTN5jw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce3f66b666b7ca05496c25b1f162711042d153357d9f77f43689a090916d5f0c

Files

ce3f66b666b7ca05496c25b1f162711042d153357d9f77f43689a090916d5f0c
.exe windows:6 windows x64 arch:x64

f32c7766f3a3ec6cdb51b750f63f85ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeleteCriticalSection

user32

CreateWindowExA

advapi32

ControlService

shell32

ShellExecuteW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext

d3dcompiler_47

D3DCompile

xinput1_4

ord2

wininet

InternetReadFile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-runtime-l1-1-0

_c_exit

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

logf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

Sections

.text
Size: 199KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f32c7766f3a3ec6cdb51b750f63f85ee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

d3d11

dwmapi

imm32

d3dcompiler_47

xinput1_4

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

iphlpapi

msvcrt

psapi

Sections

.text Size: 199KB - Virtual size: 412KB

.sedata Size: 1.4MB - Virtual size: 1.4MB

.idata Size: 2KB - Virtual size: 4KB

.rsrc Size: 48KB - Virtual size: 48KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 199KB - Virtual size: 412KB

.sedata
Size: 1.4MB - Virtual size: 1.4MB

.idata
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 48KB - Virtual size: 48KB

.sedata
Size: 4KB - Virtual size: 4KB