593f0978af842c5bce13da196ad9e77421508b74e1ab48e305e369e8ca85db3b

Sharing

Copy URL Twitter E-mail

General

Target

593f0978af842c5bce13da196ad9e77421508b74e1ab48e305e369e8ca85db3b
Size

6.5MB
MD5

907784ce09abd3b74bdff5388c034d91
SHA1

bafc60a4b1bf8738b1c8c8aa14f56af7415edd41
SHA256

593f0978af842c5bce13da196ad9e77421508b74e1ab48e305e369e8ca85db3b
SHA512

1a65ce8cc32dfda0192a8aac9b93129992a74623fe48ac7a818620d2c491794bbb097a8c90abc1597fe3ce5fd2520507d8cc193da5a0c926341d430c38c50de2
SSDEEP

98304:YFH4QvrEzX0HrtP4wtqmmaLKrtDjPm8TylkLXLjy+Iq6+pCF5s2Pd+CifyBSH:YFH4OrEzXYh6PXylkmw6+y5s2F+vKM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
593f0978af842c5bce13da196ad9e77421508b74e1ab48e305e369e8ca85db3b

Files

593f0978af842c5bce13da196ad9e77421508b74e1ab48e305e369e8ca85db3b
.exe windows:6 windows x64 arch:x64

93401c3b25f4ed244b49dcf46829c623

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA

ws2_32

freeaddrinfo
getsockopt
recv
ioctlsocket
WSAGetLastError
WSAAddressToStringW
connect
htons
closesocket
select
ntohl
shutdown
getaddrinfo
WSAStartup
setsockopt
send
socket

iphlpapi

ConvertLengthToIpv4Mask
GetAdaptersAddresses

getopt

getopt_long_a
optarg_a
optind

libcrypto-3-x64

BIO_new_mem_buf
X509_free
BIO_set_callback_ex
BIO_free
BIO_s_null
EVP_PKEY_free
PEM_read_bio_PrivateKey
PEM_read_bio_X509
BIO_set_callback_arg
BIO_get_callback_arg
BIO_new
X509_sign
X509_set_serialNumber
PEM_write_bio_PrivateKey
ASN1_INTEGER_set
X509V3_EXT_cleanup
X509_new
X509_add_ext
X509_set_pubkey
ASN1_TIME_free
X509_set_version
PEM_write_bio_X509
X509V3_EXT_conf_nid
BIO_ctrl
ASN1_INTEGER_new
X509V3_set_ctx
X509_EXTENSION_free
EVP_sha1
X509_set1_notAfter
EVP_PKEY_Q_keygen
ASN1_TIME_new
X509_set1_notBefore
BIO_s_mem
ASN1_TIME_set
PEM_read_bio_PUBKEY
ASN1_INTEGER_free

libcurl

curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_easy_init

libssl-3-x64

SSL_set_verify
SSL_shutdown
SSL_CTX_set_security_level
SSL_set_shutdown
SSL_get_error
SSL_set_connect_state
SSL_read
SSL_CTX_use_certificate
SSL_do_handshake
TLS_method
SSL_free
SSL_CTX_set_options
SSL_new
SSL_CTX_free
SSL_CTX_ctrl
SSL_CTX_use_PrivateKey
SSL_CTX_new
SSL_write
SSL_set_bio

libusb-1.0

libusb_unref_device
libusb_free_device_list
libusb_get_device_descriptor
libusb_open
libusb_claim_interface
libusb_bulk_transfer
libusb_handle_events
libusb_get_device_list
libusb_init
libusb_exit
libusb_close
libusb_set_configuration
libusb_open_device_with_vid_pid
libusb_reset_device
libusb_alloc_transfer
libusb_submit_transfer
libusb_cancel_transfer
libusb_free_transfer
libusb_control_transfer
libusb_handle_events_timeout_completed
libusb_error_name

readline

readline
add_history
read_history
write_history

zip

zip_unchange_all
zip_close

mfc140u

ord2903
ord3726
ord4510
ord4511
ord12563
ord8409
ord5709
ord4181
ord14027
ord14030
ord14033
ord14039
ord12265
ord12442
ord1671
ord293
ord1670
ord290
ord12926
ord2416
ord12564
ord3727
ord310
ord300
ord265
ord1511
ord4656
ord8058
ord1489
ord1491
ord2346
ord2344
ord2350
ord4949
ord316
ord1034
ord4658
ord280
ord286
ord1033
ord962
ord12933
ord1428
ord266
ord1510
ord1678
ord4913
ord4947
ord2921
ord296
ord285
ord1501
ord1503
ord1504
ord1667

kernel32

GetCurrentDirectoryW
CreateDirectoryW
GetProcAddress
GetModuleHandleW
Process32FirstW
LoadLibraryW
CreateMutexW
GetCurrentProcess
CreateThread
GetModuleFileNameW
LoadResource
LockResource
GetFileAttributesA
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
Sleep
CloseHandle
OutputDebugStringW
WideCharToMultiByte
DeleteCriticalSection
GetTickCount
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
Process32NextW
HeapAlloc
HeapDestroy
RaiseException
FreeLibrary
VerifyVersionInfoA
SizeofResource
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetOverlappedResult
CreateEventW
CancelIo
GetPrivateProfileStringA
FindClose
FindNextFileW
GetFullPathNameW
FindFirstFileExW
ExitProcess
CreateSemaphoreW
ReleaseSemaphore
LoadLibraryExA
GetDiskFreeSpaceA
FindResourceW
GetSystemWow64DirectoryA
GetProductInfo
GetVersionExA
GetLocalTime
VerSetConditionMask
K32GetProcessImageFileNameW
K32GetModuleFileNameExW
QueryFullProcessImageNameW
GetModuleHandleA
IsWow64Process
ReadProcessMemory
GetNativeSystemInfo
GetFileType
DeleteVolumeMountPointA
SetVolumeMountPointA
FindNextVolumeA
FindFirstVolumeA
QueryDosDeviceA
GetLogicalDriveStringsA
GetTickCount64
GetLogicalDrives
CreateFileA
SetFilePointerEx
GetVolumeNameForVolumeMountPointA
FormatMessageW
GetStartupInfoA
CreateProcessA
GetCurrentProcessId
GetVolumeInformationA
DeleteFileA
GetCurrentDirectoryA
LoadLibraryA
GetEnvironmentVariableA
SetLastError
MoveFileW
GetPrivateProfileIntW
GetCurrentThreadId
SetFilePointer
GetFileSize
FlushFileBuffers
LocalFree
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
ExitThread
FindResourceExW
GetStartupInfoW
WaitForSingleObject
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetVolumeInformationW
GetDriveTypeW
GetDiskFreeSpaceExW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
DeleteFileW
CreateFileW
CreateProcessW
TerminateThread
InitializeCriticalSection
CreatePipe
DuplicateHandle
WriteFile
ReadFile
GetStdHandle
MultiByteToWideChar
CopyFileExW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLastError

user32

MonitorFromWindow
EnumDisplaySettingsW
GetDesktopWindow
GetMonitorInfoW
GetMessageW
ReleaseDC
TranslateMessage
GetDC
SendMessageW
ShowWindow
GetSystemMetrics
DispatchMessageW

gdi32

GetDeviceCaps

advapi32

OpenServiceA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ChangeServiceConfigW
CloseServiceHandle
OpenSCManagerA
RegCreateKeyExW
QueryServiceStatusEx
StartServiceW
RegCloseKey
RegOpenKeyExW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

shlwapi

StrCmpW
PathIsDirectoryW

ole32

OleInitialize
OleUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoTaskMemFree
CoCreateGuid

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
VariantClear

msvcp140

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@HPEBD@Z
?_Xruntime_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

vcruntime140

__current_exception
__C_specific_handler
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception_context
memcpy
memmove
memset
wcsstr
strrchr
strchr
strstr
wcsrchr
_purecall
memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

exit
_invalid_parameter_noinfo
_endthread
_errno
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
strerror
_set_errno
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
perror
_initterm
_beginthreadex
_wassert
_exit
_initterm_e
terminate

api-ms-win-crt-string-l1-1-0

strcpy_s
_stricmp
toupper
strcmp
strcat_s
_strnicmp
_strdup
strtok
isdigit
wcsncpy_s
wcsncmp
_wcsicmp
wcscpy_s
strnlen
wmemcpy_s
strncmp
strncat
wcsncpy
strncpy
isspace
isxdigit

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
calloc
_recalloc
realloc
malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
puts
_get_osfhandle
__p__commode
rewind
fread
fopen
_close
_open
__stdio_common_vswprintf
_write
_set_fmode
__stdio_common_vswprintf_s
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
_wfopen_s
fopen_s
ferror
_fseeki64
_ftelli64
_fileno
fclose
fflush
fseek
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
fwrite

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_access
_mkdir
_fstat64i32

api-ms-win-crt-convert-l1-1-0

_wtoi
_itow
strtoull
strtol
wcstombs_s
atof
mbstowcs_s

api-ms-win-crt-multibyte-l1-1-0

_mbsinc
_mbschr

api-ms-win-crt-time-l1-1-0

_time64
_localtime64
strftime
_localtime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceil
_dclass
pow

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

diagnostics_relay_client_free
diagnostics_relay_client_new
diagnostics_relay_client_start_service
diagnostics_relay_goodbye
diagnostics_relay_query_ioregistry_entry
diagnostics_relay_query_ioregistry_plane
diagnostics_relay_query_mobilegestalt
diagnostics_relay_request_diagnostics
diagnostics_relay_restart
diagnostics_relay_shutdown
diagnostics_relay_sleep
idevice_connect
idevice_connection_disable_bypass_ssl
idevice_connection_disable_ssl
idevice_connection_enable_ssl
idevice_connection_get_fd
idevice_connection_receive
idevice_connection_receive_timeout
idevice_connection_send
idevice_device_list_extended_free
idevice_device_list_free
idevice_disconnect
idevice_event_subscribe
idevice_event_unsubscribe
idevice_events_subscribe
idevice_events_unsubscribe
idevice_free
idevice_get_device_list
idevice_get_device_list_extended
idevice_get_handle
idevice_get_udid
idevice_new
idevice_new_with_options
idevice_set_debug_level
libusbmuxd_set_debug_level
libusbmuxd_set_use_inotify
lockdownd_activate
lockdownd_client_free
lockdownd_client_new
lockdownd_client_new_with_handshake
lockdownd_client_set_label
lockdownd_data_classes_free
lockdownd_deactivate
lockdownd_enter_recovery
lockdownd_get_device_name
lockdownd_get_device_udid
lockdownd_get_sync_data_classes
lockdownd_get_value
lockdownd_goodbye
lockdownd_pair
lockdownd_pair_with_options
lockdownd_query_type
lockdownd_receive
lockdownd_remove_value
lockdownd_send
lockdownd_service_descriptor_free
lockdownd_set_value
lockdownd_start_service
lockdownd_start_service_with_escrow_bag
lockdownd_start_session
lockdownd_stop_session
lockdownd_strerror
lockdownd_unpair
lockdownd_validate_pair
preboard_client_free
preboard_client_new
preboard_client_start_service
preboard_commit_stashbag
preboard_create_stashbag
preboard_receive
preboard_receive_with_timeout
preboard_send
property_list_service_client_free
property_list_service_client_new
property_list_service_disable_ssl
property_list_service_enable_ssl
property_list_service_get_service_client
property_list_service_receive_plist
property_list_service_receive_plist_with_timeout
property_list_service_send_binary_plist
property_list_service_send_xml_plist
restored_client_free
restored_client_new
restored_client_set_label
restored_get_value
restored_goodbye
restored_query_type
restored_query_value
restored_reboot
restored_receive
restored_send
restored_start_restore
service_client_factory_start_service
service_client_free
service_client_new
service_disable_bypass_ssl
service_disable_ssl
service_enable_ssl
service_get_connection
service_receive
service_receive_with_timeout
service_send
usbmuxd_connect
usbmuxd_delete_pair_record
usbmuxd_device_list_free
usbmuxd_disconnect
usbmuxd_events_subscribe
usbmuxd_events_unsubscribe
usbmuxd_get_device
usbmuxd_get_device_by_udid
usbmuxd_get_device_list
usbmuxd_read_buid
usbmuxd_read_pair_record
usbmuxd_recv
usbmuxd_recv_timeout
usbmuxd_save_pair_record
usbmuxd_save_pair_record_with_device_id
usbmuxd_send
usbmuxd_subscribe
usbmuxd_unsubscribe

Sections

.text
Size: 355KB - Virtual size: 354KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 159KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 628KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93401c3b25f4ed244b49dcf46829c623

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

ws2_32

iphlpapi

getopt

libcrypto-3-x64

libcurl

libssl-3-x64

libusb-1.0

readline

zip

mfc140u

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

oleaut32

msvcp140

version

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 355KB - Virtual size: 354KB

.rdata Size: 5.4MB - Virtual size: 5.4MB

.data Size: 159KB - Virtual size: 302KB

.pdata Size: 17KB - Virtual size: 17KB

.rsrc Size: 628KB - Virtual size: 627KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 355KB - Virtual size: 354KB

.rdata
Size: 5.4MB - Virtual size: 5.4MB

.data
Size: 159KB - Virtual size: 302KB

.pdata
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 628KB - Virtual size: 627KB

.reloc
Size: 2KB - Virtual size: 2KB