487fba092496a0d065ba2a616bd0c8c9809a2220930fbcc2eed79dd9a814c0aa

Sharing

Copy URL Twitter E-mail

General

Target

487fba092496a0d065ba2a616bd0c8c9809a2220930fbcc2eed79dd9a814c0aa
Size

165KB
MD5

6f4c0c74943a5a464c8dfc269c56acf8
SHA1

70ca16fb70be27a36eca533a688f825aa827ba9b
SHA256

487fba092496a0d065ba2a616bd0c8c9809a2220930fbcc2eed79dd9a814c0aa
SHA512

a065497053af49750134a1e72e6f79f3e7c64a3683256293ea9f2bdb887291481c75691ca25a17a1fbd783d0d9c15650228da1a3849edfe4b826c87f47ef8f9e
SSDEEP

3072:3qYfYMnABX7WJXVJUU6WWGpKmUhbUMU8nmw8mc0wBie/g6:jGEjWL75dc/d/g6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
487fba092496a0d065ba2a616bd0c8c9809a2220930fbcc2eed79dd9a814c0aa

Files

487fba092496a0d065ba2a616bd0c8c9809a2220930fbcc2eed79dd9a814c0aa
.exe windows:6 windows x64 arch:x64

3f6a51d436dce41e04604d174832dd45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateEventW
Sleep
GetConsoleMode
GetLastError
SetEvent
LockResource
DeleteFileW
CloseHandle
CreateThread
LoadResource
FindResourceW
K32EnumProcesses
SetFileAttributesW
GetModuleHandleW
SetProcessWorkingSetSize
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
RtlPcToFileHeader
RaiseException
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
K32EmptyWorkingSet
CreateFileW
WaitForSingleObject
GetModuleFileNameW
DeviceIoControl
SetConsoleMode
GetStdHandle
GetCurrentProcess
SetConsoleTextAttribute
SetConsoleCtrlHandler
GetProcAddress
SizeofResource
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
InitializeConditionVariable

user32

FindWindowExW
GetWindowThreadProcessId
WindowFromPoint
SendMessageTimeoutA
IsWindowVisible
GetParent
GetCursorPos
GetWindowTextW
GetClassNameW

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
OpenProcessToken
StartServiceW
OpenServiceW

shlwapi

PathRemoveFileSpecW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memcpy
__std_terminate
_purecall
__current_exception
__std_exception_destroy
memset
memmove
__uncaught_exception
__std_exception_copy
__current_exception_context
__C_specific_handler
__AdjustPointer

api-ms-win-crt-stdio-l1-1-0

fgetpos
fgetc
fseek
_wfsopen
ungetwc
fputwc
fgetwc
__stdio_common_vsprintf_s
_set_fmode
fclose
_wfopen_s
fflush
__acrt_iob_func
__p__commode
_get_stream_buffer_pointers
fputc
_fseeki64
fread
fsetpos
__stdio_common_vfwprintf
ungetc
fwrite
setvbuf

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
calloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
abort
_register_thread_local_exe_atexit_callback
_set_app_type
_errno
_configure_wide_argv
_beginthreadex
_initialize_wide_environment
_get_initial_wide_environment
_initterm
system
terminate
_crt_atexit
_c_exit
__p___wargv
__p___argc
_initterm_e
_exit
exit
_cexit

api-ms-win-crt-string-l1-1-0

islower
wcsnlen
__strncnt
_wcsdup
isupper
strcspn

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-locale-l1-1-0

__pctype_func
___lc_locale_name_func
___lc_codepage_func
___mb_cur_max_func
setlocale
_unlock_locales
localeconv
_lock_locales
_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
frexp
ceilf

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f6a51d436dce41e04604d174832dd45

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 90KB - Virtual size: 90KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 22KB - Virtual size: 24KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 90KB - Virtual size: 90KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 22KB - Virtual size: 24KB

.reloc
Size: 1KB - Virtual size: 1KB