8ba0ce2fa50799df0b69521d62669660dfbc02c4bced07d15a8a279a7b9f2697

Sharing

Copy URL

Twitter E-mail

General

Target

8ba0ce2fa50799df0b69521d62669660dfbc02c4bced07d15a8a279a7b9f2697
Size

113KB
MD5

a56bd3b1d5a458e15030801ddedec341
SHA1

54fe7e24f8cb77b67e41bfde03532ca2cccf6588
SHA256

8ba0ce2fa50799df0b69521d62669660dfbc02c4bced07d15a8a279a7b9f2697
SHA512

7925357c97f33bdfda1bf155d62a2681d79dfc38805b7b57b598162aeabf2e6f44b0653f93e09fb6ac16ad80fb044646a3341e9812be7ed793bb1e8c2a1c167c
SSDEEP

1536:kwy4LYwV22b+/wVQgEhpmho6ZYv0iLV+pXYh0tI0c0laxnSOkuWQUG7W:fyElho6ZYv/uHlaxnSOkuWQl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ba0ce2fa50799df0b69521d62669660dfbc02c4bced07d15a8a279a7b9f2697

Files

8ba0ce2fa50799df0b69521d62669660dfbc02c4bced07d15a8a279a7b9f2697
.exe windows:6 windows x64 arch:x64

c67ef6984e63257cbea7db6005e081af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

pthreadgc2

pthread_cond_broadcast
pthread_cond_init
pthread_cond_signal
pthread_cond_wait
pthread_create
pthread_exit
pthread_join
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock

sdf_api

SDF_ReadFile
SDF_Decrypt
SDF_ExternalVerify_ECC
SDF_GenerateKeyWithKEK
SDF_GetPrivateKeyAccessRight
SDF_CalculateMAC
SDF_GenerateAgreementDataAndKeyWithECC
SDF_GenerateKeyWithECC
SDF_ExternalEncrypt_ECC
SDF_ExternalDecrypt_ECC
SDF_ExternalSign_ECC
SDF_GetDeviceInfo
SDF_ImportKeyWithISK_ECC
SDF_WriteFile
SDF_ReleasePrivateKeyAccessRight
SDF_ExchangeDigitEnvelopeBaseOnECC
SDF_GenerateKeyWithEPK_ECC
SDF_GenerateKeyWithIPK_ECC
SDF_DeleteFile
SDF_ExportSignPublicKey_ECC
SDF_HashFinal_ext
SDF_HashUpdate_ext
SDF_HashInit_ext
SDF_ExportEncPublicKey_ECC
SDF_CreateFile
SDF_InternalVerify_ECC
SDF_GenerateAgreementDataWithECC
SDF_InternalSign_ECC
SDF_GenerateRandom
SDF_GenerateStoreKEK
SDF_GenerateStoreKeyPair_ECC
HSM_DelAllUserKey
HSM_DelUserKey
HSM_InitCo
HSM_InitUser
HSM_ImportPriKey
HSM_WriteFile
HSM_ReadFile
HSM_ImportPubKey
HSM_DestroyKey
HSM_DeleteFile
HSM_EnableUserKey
HSM_ExportPubKey
HSM_C_Decrypt
HSM_ExportPriKey
HSM_StoreUserKey
HSM_ImportKey
HSM_CreateFile
HSM_ExportKey
SDF_PrivateKeyAccessPwdValid
HSM_OpenDevice
SDFE_GetKEKKeyStatus
HSM_CloseDevice
HSM_OpenSession
HSM_GetDeviceStatus
HSM_GetDeviceInfo_Ext
GetAPIVersion
HSM_GetSessionStatus
SDFE_GetECCKeyStatus
HSM_GetSessionStatus_Ext
HSM_CloseSession
HSM_GetDeviceInfo
SDF_Encrypt
SDFE_RestoreKEK
SDF_ImportStoreKEK
SDFE_BackupSignKeyPair_ECC
SDFE_BackupKEK
SDF_ImportKey
SDFE_BackupEncKeyPair_ECC
SDF_DestroyKey
SDF_HashFinal
SDFE_RestoreEncKeyPair_ECC
SDFE_RestoreSignKeyPair_ECC
SDF_ImportKeyWithKEK
SDF_HashInit
SDF_HashUpdate
SDFE_GetKEKKeyNum
SDF_DeletePrivateKeyAccessPwd
SDFE_GetECCKeyNum
SDF_CloseDevice
SDF_CloseSession
SDF_OpenDevice
SDF_OpenSession
SDF_SetPrivateKeyAccessPwd
SDF_GenerateKeyPair_ECC

kernel32

Sleep
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
UnhandledExceptionFilter

vcruntime140

__current_exception
__C_specific_handler
__current_exception_context
memset
memcmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfscanf
__p__commode
_set_fmode
__stdio_common_vsprintf_s
fread
__stdio_common_vsprintf
fopen_s
fwrite
fclose
__stdio_common_vfprintf

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_set_app_type
_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_initterm_e
_exit
exit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c67ef6984e63257cbea7db6005e081af

Headers

DLL Characteristics

File Characteristics

Imports

pthreadgc2

sdf_api

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 75KB - Virtual size: 75KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 52B

.text
Size: 75KB - Virtual size: 75KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 52B