5c2c1c71f752d104305925ef060644ea334038e9e7cc682791a222bd8ac3a8ed

Sharing

Copy URL Twitter E-mail

General

Target

5c2c1c71f752d104305925ef060644ea334038e9e7cc682791a222bd8ac3a8ed
Size

6.4MB
MD5

2c3c5eccbea20306580d40d423d75cc6
SHA1

f5e970a9f1cd0fa2d03b53cac4fab297fb7dd53e
SHA256

5c2c1c71f752d104305925ef060644ea334038e9e7cc682791a222bd8ac3a8ed
SHA512

f5d5894125d74fac0c1c60af87de05b2c7313fe837203c5350569c651b81885a996c91ee85915f136f167bf76b1c56f2f84cfb20fadfc40a4636d4c5cb9ee14b
SSDEEP

98304:6424QvrEzX0HrtP4wtqmmaoKrtDjPm8TylkLXLjy+Iq6+pCF5s2Pd+CifyBi6:6424OrEzXYhJPXylkmw6+y5s2F+vKc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c2c1c71f752d104305925ef060644ea334038e9e7cc682791a222bd8ac3a8ed

Files

5c2c1c71f752d104305925ef060644ea334038e9e7cc682791a222bd8ac3a8ed
.exe windows:6 windows x86 arch:x86

4797afb07245cfc637a35cab1eda75d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA

ws2_32

ioctlsocket
freeaddrinfo
recv
setsockopt
closesocket
select
ntohl
shutdown
WSAGetLastError
htons
WSAStartup
getaddrinfo
WSAAddressToStringW
send
socket
connect
getsockopt

iphlpapi

GetAdaptersAddresses
ConvertLengthToIpv4Mask

getopt

getopt_long_a
optarg_a
optind

libcrypto-3

BIO_new_mem_buf
X509_free
X509_sign
X509_set_serialNumber
PEM_write_bio_PrivateKey
ASN1_INTEGER_set
X509V3_EXT_cleanup
X509V3_set_ctx
EVP_sha1
EVP_PKEY_Q_keygen
ASN1_TIME_new
BIO_new
BIO_s_mem
ASN1_INTEGER_free
PEM_read_bio_PUBKEY
ASN1_TIME_set
BIO_get_callback_arg
BIO_set_callback_arg
PEM_read_bio_X509
PEM_read_bio_PrivateKey
EVP_PKEY_free
BIO_s_null
X509_new
X509_add_ext
X509_set_pubkey
ASN1_TIME_free
X509_set_version
PEM_write_bio_X509
X509V3_EXT_conf_nid
BIO_ctrl
ASN1_INTEGER_new
X509_EXTENSION_free
BIO_free
BIO_set_callback_ex
X509_set1_notBefore
X509_set1_notAfter

libcurl

curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_easy_init

libssl-3

SSL_set_verify
SSL_shutdown
SSL_CTX_set_security_level
SSL_set_shutdown
SSL_get_error
SSL_set_connect_state
SSL_read
SSL_CTX_use_certificate
SSL_do_handshake
TLS_method
SSL_free
SSL_CTX_set_options
SSL_new
SSL_CTX_free
SSL_CTX_ctrl
SSL_CTX_use_PrivateKey
SSL_CTX_new
SSL_write
SSL_set_bio

libusb-1.0

libusb_unref_device
libusb_free_device_list
libusb_get_device_descriptor
libusb_open
libusb_claim_interface
libusb_bulk_transfer
libusb_handle_events
libusb_get_device_list
libusb_init
libusb_exit
libusb_close
libusb_set_configuration
libusb_open_device_with_vid_pid
libusb_reset_device
libusb_alloc_transfer
libusb_submit_transfer
libusb_cancel_transfer
libusb_free_transfer
libusb_control_transfer
libusb_handle_events_timeout_completed
libusb_error_name

readline

readline
add_history
read_history
write_history

zip

zip_unchange_all
zip_close

mfc140u

ord2990
ord3846
ord4663
ord4664
ord12884
ord8712
ord5921
ord4323
ord14405
ord14408
ord14411
ord14417
ord12584
ord12762
ord1693
ord293
ord1692
ord290
ord13251
ord2459
ord12885
ord3847
ord310
ord300
ord265
ord1533
ord4815
ord8360
ord1511
ord1513
ord2385
ord2383
ord2389
ord5112
ord316
ord1046
ord4817
ord280
ord286
ord1045
ord974
ord13258
ord1450
ord266
ord1532
ord1700
ord5074
ord5110
ord3009
ord296
ord285
ord1523
ord1525
ord1526
ord1689

kernel32

GetCurrentDirectoryW
CreateDirectoryW
FreeLibrary
Process32NextW
GetProcAddress
GetModuleHandleW
CreateMutexW
GetCurrentProcess
CreateThread
GetTickCount
LoadResource
LockResource
Process32FirstW
GetModuleFileNameW
OpenProcess
TerminateProcess
Sleep
CloseHandle
OutputDebugStringW
GetFileAttributesA
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
CreateToolhelp32Snapshot
HeapAlloc
HeapDestroy
GetLastError
RaiseException
LoadLibraryW
GetLocalTime
SizeofResource
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetPrivateProfileStringA
FindClose
FindNextFileW
GetFullPathNameW
FindFirstFileExW
ExitProcess
GetOverlappedResult
CreateEventW
CancelIo
CreateSemaphoreW
ReleaseSemaphore
LoadLibraryExA
GetDiskFreeSpaceA
VerifyVersionInfoA
GetSystemWow64DirectoryA
GetProductInfo
GetVersionExA
FindResourceW
VerSetConditionMask
K32GetProcessImageFileNameW
K32GetModuleFileNameExW
QueryFullProcessImageNameW
GetModuleHandleA
IsWow64Process
ReadProcessMemory
GetNativeSystemInfo
GetFileType
DeleteVolumeMountPointA
SetVolumeMountPointA
FindNextVolumeA
FindFirstVolumeA
QueryDosDeviceA
GetLogicalDriveStringsA
GetTickCount64
GetLogicalDrives
CreateFileA
SetFilePointerEx
GetVolumeNameForVolumeMountPointA
FormatMessageW
GetStartupInfoA
CreateProcessA
GetCurrentProcessId
GetVolumeInformationA
DeleteFileA
GetCurrentDirectoryA
LoadLibraryA
GetEnvironmentVariableA
SetLastError
MoveFileW
GetPrivateProfileIntW
GetCurrentThreadId
SetFilePointer
GetFileSize
FlushFileBuffers
LocalFree
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
ExitThread
FindResourceExW
GetStartupInfoW
WaitForSingleObject
DeviceIoControl
GetVolumePathNamesForVolumeNameW
GetVolumeInformationW
GetDriveTypeW
GetDiskFreeSpaceExW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
DeleteFileW
CreateFileW
CreateProcessW
TerminateThread
InitializeCriticalSection
CreatePipe
DuplicateHandle
WriteFile
ReadFile
GetStdHandle
MultiByteToWideChar
CopyFileExW
WritePrivateProfileStringW
GetPrivateProfileStringW

user32

SendMessageW
ReleaseDC
GetDesktopWindow
GetDC
ShowWindow
EnumDisplaySettingsW
DispatchMessageW
GetSystemMetrics
MonitorFromWindow
GetMonitorInfoW
GetMessageW
TranslateMessage

gdi32

GetDeviceCaps

advapi32

OpenServiceA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ChangeServiceConfigW
CloseServiceHandle
OpenSCManagerA
RegCreateKeyExW
QueryServiceStatusEx
StartServiceW
RegCloseKey
RegOpenKeyExW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation

shlwapi

PathIsDirectoryW
StrCmpW

ole32

OleInitialize
OleUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoTaskMemFree
CoCreateGuid

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
VariantClear

msvcp140

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Getname@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@HPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xruntime_error@std@@YAXPBD@Z

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

vcruntime140

__current_exception_context
wcsstr
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
__std_terminate
memcpy
memmove
memset
strrchr
strchr
strstr
wcsrchr
_purecall
memcmp
__current_exception

api-ms-win-crt-runtime-l1-1-0

_exit
_errno
_invalid_parameter_noinfo
perror
_initterm_e
_wassert
_register_thread_local_exe_atexit_callback
_c_exit
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_initterm
_get_wide_winmain_command_line
_initialize_onexit_table
_initialize_wide_environment
exit
strerror
_configure_wide_argv
_set_errno
_invalid_parameter_noinfo_noreturn
_endthread
_set_app_type
_seh_filter_exe
_cexit
_beginthreadex

api-ms-win-crt-string-l1-1-0

_strnicmp
toupper
strcpy_s
wcsncpy
strncmp
wmemcpy_s
strnlen
wcscpy_s
_wcsicmp
wcsncmp
wcsncpy_s
isdigit
strtok
_strdup
isspace
isxdigit
strncpy
strcat_s
_stricmp
strncat

api-ms-win-crt-heap-l1-1-0

malloc
calloc
realloc
free
_recalloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
rewind
fread
puts
_get_osfhandle
fopen
_fileno
__stdio_common_vswprintf_s
fwrite
ftell
__stdio_common_vswprintf
fseek
fflush
fclose
_close
_open
_write
__stdio_common_vsprintf_s
fopen_s
__stdio_common_vsnprintf_s
_wfopen_s
__stdio_common_vsscanf
ferror
_fseeki64
_ftelli64
__p__commode
__acrt_iob_func
_set_fmode
__stdio_common_vfprintf

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_stat64i32
_mkdir
_access

api-ms-win-crt-convert-l1-1-0

strtol
_wtoi
_itow
strtoull
mbstowcs_s
wcstombs_s
atof

api-ms-win-crt-multibyte-l1-1-0

_mbsinc
_mbschr

api-ms-win-crt-time-l1-1-0

_localtime64
strftime
_localtime64_s
_time64

api-ms-win-crt-math-l1-1-0

ceil
_dclass
__setusermatherr
_libm_sse2_pow_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

diagnostics_relay_client_free
diagnostics_relay_client_new
diagnostics_relay_client_start_service
diagnostics_relay_goodbye
diagnostics_relay_query_ioregistry_entry
diagnostics_relay_query_ioregistry_plane
diagnostics_relay_query_mobilegestalt
diagnostics_relay_request_diagnostics
diagnostics_relay_restart
diagnostics_relay_shutdown
diagnostics_relay_sleep
idevice_connect
idevice_connection_disable_bypass_ssl
idevice_connection_disable_ssl
idevice_connection_enable_ssl
idevice_connection_get_fd
idevice_connection_receive
idevice_connection_receive_timeout
idevice_connection_send
idevice_device_list_extended_free
idevice_device_list_free
idevice_disconnect
idevice_event_subscribe
idevice_event_unsubscribe
idevice_events_subscribe
idevice_events_unsubscribe
idevice_free
idevice_get_device_list
idevice_get_device_list_extended
idevice_get_handle
idevice_get_udid
idevice_new
idevice_new_with_options
idevice_set_debug_level
libusbmuxd_set_debug_level
libusbmuxd_set_use_inotify
lockdownd_activate
lockdownd_client_free
lockdownd_client_new
lockdownd_client_new_with_handshake
lockdownd_client_set_label
lockdownd_data_classes_free
lockdownd_deactivate
lockdownd_enter_recovery
lockdownd_get_device_name
lockdownd_get_device_udid
lockdownd_get_sync_data_classes
lockdownd_get_value
lockdownd_goodbye
lockdownd_pair
lockdownd_pair_with_options
lockdownd_query_type
lockdownd_receive
lockdownd_remove_value
lockdownd_send
lockdownd_service_descriptor_free
lockdownd_set_value
lockdownd_start_service
lockdownd_start_service_with_escrow_bag
lockdownd_start_session
lockdownd_stop_session
lockdownd_strerror
lockdownd_unpair
lockdownd_validate_pair
preboard_client_free
preboard_client_new
preboard_client_start_service
preboard_commit_stashbag
preboard_create_stashbag
preboard_receive
preboard_receive_with_timeout
preboard_send
property_list_service_client_free
property_list_service_client_new
property_list_service_disable_ssl
property_list_service_enable_ssl
property_list_service_get_service_client
property_list_service_receive_plist
property_list_service_receive_plist_with_timeout
property_list_service_send_binary_plist
property_list_service_send_xml_plist
restored_client_free
restored_client_new
restored_client_set_label
restored_get_value
restored_goodbye
restored_query_type
restored_query_value
restored_reboot
restored_receive
restored_send
restored_start_restore
service_client_factory_start_service
service_client_free
service_client_new
service_disable_bypass_ssl
service_disable_ssl
service_enable_ssl
service_get_connection
service_receive
service_receive_with_timeout
service_send
usbmuxd_connect
usbmuxd_delete_pair_record
usbmuxd_device_list_free
usbmuxd_disconnect
usbmuxd_events_subscribe
usbmuxd_events_unsubscribe
usbmuxd_get_device
usbmuxd_get_device_by_udid
usbmuxd_get_device_list
usbmuxd_read_buid
usbmuxd_read_pair_record
usbmuxd_recv
usbmuxd_recv_timeout
usbmuxd_save_pair_record
usbmuxd_save_pair_record_with_device_id
usbmuxd_send
usbmuxd_subscribe
usbmuxd_unsubscribe

Sections

.text
Size: 316KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 155KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 628KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4797afb07245cfc637a35cab1eda75d4

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

ws2_32

iphlpapi

getopt

libcrypto-3

libcurl

libssl-3

libusb-1.0

readline

zip

mfc140u

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

oleaut32

msvcp140

version

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 316KB - Virtual size: 315KB

.rdata Size: 5.3MB - Virtual size: 5.3MB

.data Size: 155KB - Virtual size: 295KB

.rsrc Size: 628KB - Virtual size: 627KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 316KB - Virtual size: 315KB

.rdata
Size: 5.3MB - Virtual size: 5.3MB

.data
Size: 155KB - Virtual size: 295KB

.rsrc
Size: 628KB - Virtual size: 627KB

.reloc
Size: 24KB - Virtual size: 23KB