37c63dedc0899e22874058b2008071cb341b7611e3a4f3be4a40c762e06a7195

Sharing

Copy URL

Twitter E-mail

General

Target

37c63dedc0899e22874058b2008071cb341b7611e3a4f3be4a40c762e06a7195
Size

1.4MB
MD5

2fa2e0ff6153e4cdf42ef6c26e8b5dae
SHA1

57bdba7adddb94b58413f1242b34bbd0d2e10987
SHA256

37c63dedc0899e22874058b2008071cb341b7611e3a4f3be4a40c762e06a7195
SHA512

6ad6057b7423653f5af9ebf0d5756e841b0c440ff50dc319e4daaf83308387d59871bfc32416a52e6b5b3f1c66d94cca1e5a4fbe0d6233fd983cd1c775fac548
SSDEEP

24576:VMkltb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VBltbLNiXicJFFRGNzj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37c63dedc0899e22874058b2008071cb341b7611e3a4f3be4a40c762e06a7195

Files

37c63dedc0899e22874058b2008071cb341b7611e3a4f3be4a40c762e06a7195
.exe windows:6 windows x64 arch:x64

667104a518760a4db05b476ebdd65113

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FindNextFileW
DeviceIoControl
RemoveDirectoryW
GetUserDefaultUILanguage
FindClose
CreateFileW
MultiByteToWideChar
DeleteFileW
LoadLibraryW
GetProcAddress
FindFirstFileW
GetModuleFileNameW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WTSGetActiveConsoleSessionId
FindResourceW
LoadResource
ResetEvent
FindResourceExW
LockResource
SetEvent
GetTickCount64
Sleep
CreateEventW
QueueUserWorkItem
OpenEventW
WaitForSingleObject
TerminateProcess
GetCurrentProcess
SetLastError
SizeofResource
GetProcessHeap
DeleteCriticalSection
HeapDestroy
GetLocalTime
HeapAlloc
RaiseException
CloseHandle
HeapReAlloc
OutputDebugStringW
GetLastError
HeapSize
InitializeCriticalSectionEx
GetModuleHandleW
HeapFree
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
CompareStringW
GetFileType
GetCommandLineW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA

user32

RegisterPowerSettingNotification
wsprintfW
LoadStringW

advapi32

CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
OpenServiceW
RegisterServiceCtrlHandlerExW
SetSecurityDescriptorDacl
SetServiceStatus
RegSetValueExW
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
AllocateAndInitializeSid
SetEntriesInAclW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW

shell32

ShellExecuteW

winbio

WinBioLockUnit
WinBioFree
WinBioUnlockUnit
WinBioEnumEnrollments
WinBioOpenSession
WinBioCloseSession
WinBioEnumBiometricUnits

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

667104a518760a4db05b476ebdd65113

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

winbio

setupapi

Sections

.text Size: 109KB - Virtual size: 109KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 6KB - Virtual size: 6KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 1.2MB - Virtual size: 1.9MB

.text
Size: 109KB - Virtual size: 109KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 6KB - Virtual size: 6KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 1.2MB - Virtual size: 1.9MB