7cfaf48385df2f8e8c9b59324e9cad2e203b525f9fdc91065b3ae54447a52416

Sharing

Copy URL Twitter E-mail

General

Target

7cfaf48385df2f8e8c9b59324e9cad2e203b525f9fdc91065b3ae54447a52416
Size

4.5MB
MD5

cbd0870053393fae6e66ec88ba1e2976
SHA1

5afdc394ae6d02a642ea63b17bfde5b53442fab2
SHA256

7cfaf48385df2f8e8c9b59324e9cad2e203b525f9fdc91065b3ae54447a52416
SHA512

99d478d2158d1ff281f62fb56516cb3c091e941c6100030deb6b3aed7492c7e70cab5f55d3dd572d4eaeade6b1ce8bba8b7c1bc170b48beac071f46aaab144d9
SSDEEP

98304:HB+t6cOpZGKGz2iHqjvTnYh5Xd6A6nj2jF:h+t6cOvGhz2iHqjjA6n8F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7cfaf48385df2f8e8c9b59324e9cad2e203b525f9fdc91065b3ae54447a52416

Files

7cfaf48385df2f8e8c9b59324e9cad2e203b525f9fdc91065b3ae54447a52416
.exe windows:6 windows x64 arch:x64

e583fa6f63702dcb6d2b605aaa217212

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW
NdrServerCall2
RpcBindingVectorFree
RpcServerInqBindings
RpcServerListen
RpcServerRegisterIf3
RpcServerUnregisterIf
NdrClientCall3
NdrServerCallAll
RpcServerUseProtseqEpW
RpcEpRegisterW
RpcEpUnregister
RpcServerInqCallAttributesW

kernel32

CreateDirectoryW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
CreateThreadpoolWork
SubmitThreadpoolWork
WideCharToMultiByte
CreateProcessW
GetCurrentThreadId
GetFileAttributesW
OpenProcess
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LCMapStringEx
GetSystemTimeAsFileTime
InitializeSListHead
K32GetModuleBaseNameW
K32EnumProcessModules
K32EnumProcesses
Sleep
GetLocaleInfoEx
FormatMessageA
SystemTimeToFileTime
CompareStringEx
K32GetModuleFileNameExW
GetStdHandle
FindClose
MoveFileW
GetLocaleInfoW
GetUserGeoID
GetExitCodeProcess
GetUserDefaultLCID
GetCPInfo
RtlUnwindEx
GetPackagesByPackageFamily
InterlockedPushEntrySList
RtlCaptureStackBackTrace
GetModuleHandleExW
CloseThreadpoolWork
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
WTSGetActiveConsoleSessionId
FreeLibraryWhenCallbackReturns
lstrlenW
FormatMessageW
LocalFree
CreateFileW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetVolumeInformationW
DeviceIoControl
GlobalMemoryStatusEx
OutputDebugStringA
OutputDebugStringW
LocalSize
LocalAlloc
GetModuleFileNameW
ExitProcess
GetCurrentProcess
CreatePipe
SetHandleInformation
CloseHandle
GetFileAttributesA
ReadFile
CloseThreadpoolTimer
GetUserDefaultUILanguage
GetCurrentProcessId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitOnceComplete
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FlushFileBuffers
SetEndOfFile
SetFilePointer
WriteFile
SetLastError
GetModuleHandleW
InitOnceBeginInitialize
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
TryAcquireSRWLockExclusive
InitializeSRWLock
RaiseException
RtlPcToFileHeader
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
DeleteVolumeMountPointW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetFileSize
GetFileTime
GetLogicalDrives
QueryDosDeviceW
RemoveDirectoryW
GetVolumeNameForVolumeMountPointW
SetVolumeMountPointW
GetUserDefaultLangID
WaitForSingleObjectEx
GetSystemTimePreciseAsFileTime
QueryPerformanceFrequency
ReleaseMutex
CreateMutexW
RtlVirtualUnwind
MultiByteToWideChar
GetStringTypeW
CreateEventW
SystemTimeToTzSpecificLocalTime
SetThreadpoolTimer
CreateThreadpoolTimer
GetSystemTime
CreateThread
WaitForSingleObject
GetLastError
__C_specific_handler
LoadLibraryW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
TerminateProcess
GetProcessId
GetSystemDirectoryW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetProcAddress
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
RtlLookupFunctionEntry
RtlCaptureContext
GetPrivateProfileStringA
GetPrivateProfileStringW
EncodePointer
FileTimeToSystemTime

advapi32

SetNamedSecurityInfoW
IsValidSid
InitializeAcl
GetLengthSid
GetAclInformation
GetAce
CopySid
AddAce
RegGetValueW
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegSetKeyValueW
RegDeleteKeyValueW
RegSetValueExW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyW
RegDeleteKeyW
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
CreateProcessAsUserW
OpenProcessToken
CryptAcquireContextA
AdjustTokenPrivileges
DuplicateTokenEx
SetTokenInformation
EventWriteTransfer
EventSetInformation
DeleteService
CreateServiceW
ControlService
LookupPrivilegeValueW
EventWriteString
EventUnregister
EventRegister
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
LookupAccountSidW
CloseServiceHandle
ChangeServiceConfig2W
SetEntriesInAclW
QueryServiceConfigW
StartServiceW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetNamedSecurityInfoW
FreeSid
AllocateAndInitializeSid
QueryServiceStatus
OpenServiceW
OpenSCManagerW

ole32

CoInitialize
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitializeEx
CoCreateInstance
CoCreateGuid
CoSetProxyBlanket

oleaut32

SysAllocString
CreateErrorInfo
VariantClear
SysFreeString
SysStringLen
VariantInit
SetErrorInfo
VariantChangeType
SafeArrayGetElement
GetErrorInfo
SafeArrayGetLBound
SafeArrayGetUBound

iphlpapi

GetAdaptersAddresses

user32

UnregisterDeviceNotification
RegisterDeviceNotificationW
UnregisterPowerSettingNotification
wsprintfW
GetWindowThreadProcessId
MessageBoxW
RegisterPowerSettingNotification

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSQueryUserToken

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

winhttp

WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSetTimeouts
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpSendRequest

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shell32

SHGetKnownFolderPath
ShellExecuteExW

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGetProperty
BCryptOpenAlgorithmProvider

shlwapi

PathFileExistsW

api-ms-win-crt-runtime-l1-1-0

_exit
_configure_wide_argv
abort
_initterm_e
__p___argc
__p___wargv
_seh_filter_exe
_initterm
_invalid_parameter_noinfo
_c_exit
_endthreadex
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_set_app_type
_configure_narrow_argv
_seh_filter_dll
_beginthreadex
terminate
exit
_errno
_crt_at_quick_exit
_cexit
_get_initial_wide_environment
_initialize_wide_environment
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_wassert
_crt_atexit

api-ms-win-crt-string-l1-1-0

_wcsicmp
iswalpha
iswupper
towlower
wcsnlen
tolower
wcsncpy_s
isspace
wcstok_s
_wcsdup
_wcsupr_s
wcscat_s
strncpy_s
isdigit
__strncnt
strcmp
toupper
islower
strtok_s
strcpy_s
wcscpy_s
memset
isupper
strncmp
strcat_s
strcspn

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf
_wfsopen
_fsopen
_set_fmode
__acrt_iob_func
__stdio_common_vfwprintf
_get_stream_buffer_pointers
fclose
__stdio_common_vsscanf
__stdio_common_vfprintf
fflush
fgetc
fgetpos
fputc
ftell
fseek
fread
__stdio_common_vswprintf_s
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
putc
getc
fopen_s
__p__commode
fputs

api-ms-win-crt-convert-l1-1-0

_wtoi
atof
strtoull
wcstol
wcstoul
atoi
strtol
wcstoll
strtod
mbstowcs_s
strtof
atol
strtoll
mbsrtowcs_s

api-ms-win-crt-math-l1-1-0

powf
pow
ldexp
frexp
__setusermatherr
_dclass
_dsign

api-ms-win-crt-heap-l1-1-0

_recalloc
calloc
_set_new_mode
malloc
free
realloc
_callnewh

api-ms-win-crt-time-l1-1-0

_localtime64_s
strftime
_Strftime
_Gettnames
_Wcsftime
_W_Gettnames
_W_Getmonths
_W_Getdays
_Getmonths
_gmtime64_s
_difftime64
_Getdays
_mktime64
_time64

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func
___lc_locale_name_func
_unlock_locales
___lc_codepage_func
_lock_locales
__pctype_func
_configthreadlocale
setlocale
localeconv
___mb_cur_max_func

api-ms-win-crt-filesystem-l1-1-0

rename
_rmdir
_findnext64i32
_findfirst64i32
_findclose
_lock_file
_unlock_file
remove
_stat64i32
_mkdir

api-ms-win-crt-utility-l1-1-0

srand
rand
rand_s

winsqlite3

sqlite3_free
sqlite3_errmsg
sqlite3_close
sqlite3_finalize
sqlite3_step
sqlite3_bind_text
sqlite3_bind_null
sqlite3_bind_int
sqlite3_prepare_v2
sqlite3_open
sqlite3_bind_double
sqlite3_exec

wininet

InternetGetConnectedState

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 640KB - Virtual size: 647KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e583fa6f63702dcb6d2b605aaa217212

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

kernel32

advapi32

ole32

oleaut32

iphlpapi

user32

wtsapi32

userenv

setupapi

api-ms-win-security-base-l1-2-2

api-ms-win-power-base-l1-1-0

winhttp

version

shell32

bcrypt

shlwapi

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

winsqlite3

wininet

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 507KB - Virtual size: 506KB

.data Size: 640KB - Virtual size: 647KB

.pdata Size: 50KB - Virtual size: 49KB

_RDATA Size: 512B - Virtual size: 256B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 507KB - Virtual size: 506KB

.data
Size: 640KB - Virtual size: 647KB

.pdata
Size: 50KB - Virtual size: 49KB

_RDATA
Size: 512B - Virtual size: 256B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 572KB - Virtual size: 576KB