e34fcb771bd248b6674a5394fc3dce97a64c86792c1bfa7e36dc6bbdf1546991

Sharing

Copy URL

Twitter E-mail

General

Target

e34fcb771bd248b6674a5394fc3dce97a64c86792c1bfa7e36dc6bbdf1546991
Size

286KB
MD5

ebae7b3b94b262e2ea7e731f05117a2e
SHA1

19b7cb83430f9e2e74cf38381d48dc228301f6d2
SHA256

e34fcb771bd248b6674a5394fc3dce97a64c86792c1bfa7e36dc6bbdf1546991
SHA512

a14a6052571aae74384bb2694f88dfc41e2ea86b429ec9fab4a384f7b9bcc45ddef91bf48dcb9c90e2f26013b1d97a9376cefd6d296dea4472cd0c5de3042dc2
SSDEEP

6144:eTZRoJX4BT45W7wz2O7mEYwzslLM9J2xNFfH0hNQ96qHiHeG3MK9Ahi0pXdJ6GIq:eTboWBT45W8mRwzs9M9J2xNFfHeO96qW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e34fcb771bd248b6674a5394fc3dce97a64c86792c1bfa7e36dc6bbdf1546991

Files

e34fcb771bd248b6674a5394fc3dce97a64c86792c1bfa7e36dc6bbdf1546991
.exe windows:6 windows x64 arch:x64

4a6ad3aa28971622ba09286823ba2827

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

kernel32

CloseHandle
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetThreadLocale
HeapAlloc
HeapFree
InitializeSListHead
IsBadReadPtr
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryA
MapViewOfFile
OpenFileMappingA
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
lstrlenA

user32

MessageBoxA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
memcpy
memmove
memset

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
exit
terminate

api-ms-win-crt-string-l1-1-0

_stricmp
_wcsnicmp
strcmp
strlen

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
free
malloc
realloc

api-ms-win-crt-convert-l1-1-0

mbstowcs
strtol
wcstombs

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a6ad3aa28971622ba09286823ba2827

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 272KB - Virtual size: 271KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.00cfg Size: 512B - Virtual size: 56B

.retplne Size: 512B - Virtual size: 92B

.reloc Size: 512B - Virtual size: 96B

.text
Size: 272KB - Virtual size: 271KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.00cfg
Size: 512B - Virtual size: 56B

.retplne
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 96B