795a93cb14b9a1656c2258aad8c608e1cfcb994f3817a60f148cad665e7a2774

Sharing

Copy URL Twitter E-mail

General

Target

795a93cb14b9a1656c2258aad8c608e1cfcb994f3817a60f148cad665e7a2774
Size

408KB
MD5

f100579d93934b0df0a64685446ca040
SHA1

b45e6e918c48c1ca578dc3dc5fdad33afea9f149
SHA256

795a93cb14b9a1656c2258aad8c608e1cfcb994f3817a60f148cad665e7a2774
SHA512

c099ab10ccf49ef9da3c23962bcd10420e99376b4e5c6e606fd5c786645a88343ae52c0fcc061ed3e0a5c07acc632afe761c21e517552d30602fdacdc133d3c5
SSDEEP

6144:flYhD0XJZaCiyTKQE0sK/YlBoEldqecYiDMGHeU4fw:fLtlTHbYldfqefo15

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
795a93cb14b9a1656c2258aad8c608e1cfcb994f3817a60f148cad665e7a2774

Files

795a93cb14b9a1656c2258aad8c608e1cfcb994f3817a60f148cad665e7a2774
.exe windows:6 windows x64 arch:x64

720161037b18cb64d3db1e199686fc1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlVirtualUnwind
NtWriteVirtualMemory
NtQueryInformationProcess
RtlGetVersion
NtAllocateVirtualMemory
RtlCaptureContext
RtlLookupFunctionEntry
NtOpenProcess
NtCreateThreadEx
NtQuerySystemInformation

advapi32

RegQueryValueExA

iphlpapi

GetIfTable2
FreeMibTable
GetIfEntry2

kernel32

WriteConsoleW
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetConsoleMode
TlsSetValue
CloseHandle
OpenProcess
GetProcessTimes
LocalFree
VirtualQueryEx
ReadProcessMemory
GetSystemTimeAsFileTime
GetSystemTimes
GetProcessIoCounters
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetSystemInfo
CreateFileW
DeviceIoControl
GetLogicalDrives
GetTickCount64
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetCurrentProcessId
GetDriveTypeW
GetVolumeInformationW
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
ReleaseMutex
ReleaseSRWLockShared
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentProcess
GetCurrentThread
GetProcAddress
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetStdHandle
WaitForSingleObject
QueryPerformanceCounter
WakeAllConditionVariable
WakeConditionVariable
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleW
FormatMessageW
CreateThread
TlsGetValue
IsProcessorFeaturePresent
GetModuleHandleA

netapi32

NetQueryDisplayInformation
NetUserGetLocalGroups
NetApiBufferFree

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

oleaut32

SysFreeString
VariantClear
SysAllocString

pdh

PdhRemoveCounter
PdhOpenQueryA
PdhCloseQuery
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhLookupPerfNameByIndexW
PdhAddCounterW

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW
EnumProcessModulesEx

shell32

CommandLineToArgvW

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3
memset
memcpy
_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
memmove
memcmp

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
terminate
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

720161037b18cb64d3db1e199686fc1d

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

advapi32

iphlpapi

kernel32

netapi32

ole32

oleaut32

pdh

powrprof

psapi

shell32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 291KB - Virtual size: 291KB

.rdata Size: 97KB - Virtual size: 97KB

.data Size: 512B - Virtual size: 952B

.pdata Size: 16KB - Virtual size: 16KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 291KB - Virtual size: 291KB

.rdata
Size: 97KB - Virtual size: 97KB

.data
Size: 512B - Virtual size: 952B

.pdata
Size: 16KB - Virtual size: 16KB

.reloc
Size: 1KB - Virtual size: 1KB