79289ae11b916f061f5b5a8c18734745

Sharing

Copy URL Twitter E-mail

General

Target

79289ae11b916f061f5b5a8c18734745
Size

1.4MB
MD5

79289ae11b916f061f5b5a8c18734745
SHA1

8b5f57c0ee18393cf66f7b870c5266b00ea458ec
SHA256

44ce5d723cf91a4d05aa7765494808a1857f81b868f0a230b10001af5e4940b1
SHA512

b73e0602fb661957618b1e4ae5c382a241920fefdace290facae47f9ae8c63ea9659a70340cddf7341e8afd8a9d7a0bc0f4b872b04a2b880c6bf1f770f00ee24
SSDEEP

24576:UyxnYahSP/Ax+Zfgtr/xf6g7Bz0sCLn1Lu+zGJzGKqkfKbYiG+ji:UyxXhSPoP/xfZVXCLIza9G+ji

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79289ae11b916f061f5b5a8c18734745

Files

79289ae11b916f061f5b5a8c18734745
.exe windows:4 windows x64 arch:x64

71faf1882456831ff03df57bc3d22a72

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateFileA
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
PurgeComm
QueryDosDeviceA
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCommConfig
SetCommTimeouts
SetConsoleCursorPosition
SetUnhandledExceptionFilter
Sleep
SleepEx
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

_access
_close
_execv
_fdopen
_fileno
_isatty
_read
_strdup
_write
__C_specific_handler
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_exit
_fmode
_initterm
_localtime64
_lock
_onexit
_open_osfhandle
_stat64
_stricmp
_strnicmp
_time64
_unlock
_vsnprintf
abort
atof
atoi
calloc
ceil
div
exit
fclose
feof
fflush
floor
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
isalpha
islower
isspace
isupper
ldiv
localeconv
log10
malloc
mbstowcs
memcmp
memcpy
memmove
memset
perror
printf
puts
raise
rand
realloc
rewind
setlocale
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
tolower
toupper
vfprintf
vprintf
vsprintf
wcstombs

user32

MessageBoxA

ws2_32

WSAGetLastError
WSAIoctl
__WSAFDIsSet
accept
bind
closesocket
connect
getsockname
htonl
htons
inet_addr
inet_ntoa
listen
recv
select
send
setsockopt
shutdown
socket

libcurl-4

curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_reset
curl_easy_setopt
curl_global_cleanup
curl_global_init
curl_multi_add_handle
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_slist_append
curl_slist_free_all
curl_version_info

libjansson-4

json_array
json_array_append_new
json_array_get
json_array_size
json_deep_copy
json_delete
json_dumps
json_integer_value
json_load_file
json_loadb
json_loads
json_number_value
json_object
json_object_get
json_object_set_new
json_real_value
json_string
json_string_value

pthreadgc2

pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_create
pthread_detach
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_self
pthread_setcancelstate
pthread_setcanceltype
ptw32_pop_cleanup
ptw32_push_cleanup

libusb-1.0

libusb_bulk_transfer
libusb_claim_interface
libusb_close
libusb_control_transfer
libusb_detach_kernel_driver
libusb_error_name
libusb_exit
libusb_free_config_descriptor
libusb_free_device_list
libusb_get_bus_number
libusb_get_config_descriptor
libusb_get_device_address
libusb_get_device_descriptor
libusb_get_device_list
libusb_get_string_descriptor_ascii
libusb_init
libusb_open
libusb_ref_device
libusb_release_interface
libusb_reset_device
libusb_set_configuration
libusb_unref_device

pdcurses

LINES
cbreak
delwin
echo
endwin
erase
getmaxx
getmaxy
halfdelay
idlok
immedok
initscr
keypad
leaveok
mvwhline
mvwin
mvwprintw
newwin
nocbreak
noecho
scrollok
stdscr
touchwin
vw_printw
waddstr
wattroff
wattron
wclear
wclrtoeol
wgetch
wgetnstr
wmove
wprintw
wrefresh
wresize

libblkmaker-0.1-0

blkmk_address_to_script
blkmk_append_coinbase_safe
blkmk_get_data
blkmk_init_generation2
blkmk_sha256_impl
blkmk_time_left
blkmk_work_left
blktmpl_addcaps
blktmpl_create
blktmpl_free
blktmpl_get_longpoll

libblkmaker_jansson-0.1-0

blkmk_submit_foreign_jansson
blkmk_submit_jansson
blktmpl_add_jansson
blktmpl_request_jansson

Sections

.text
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 495KB - Virtual size: 494KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71faf1882456831ff03df57bc3d22a72

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

ws2_32

libcurl-4

libjansson-4

pthreadgc2

libusb-1.0

pdcurses

libblkmaker-0.1-0

libblkmaker_jansson-0.1-0

Sections

.text Size: 416KB - Virtual size: 416KB

.data Size: 13KB - Virtual size: 13KB

.rdata Size: 68KB - Virtual size: 67KB

.pdata Size: 17KB - Virtual size: 17KB

.xdata Size: 15KB - Virtual size: 15KB

.bss Size: - Virtual size: 27KB

.idata Size: 11KB - Virtual size: 11KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 72B

/4 Size: 1KB - Virtual size: 1KB

/19 Size: 495KB - Virtual size: 494KB

/31 Size: 19KB - Virtual size: 19KB

/45 Size: 59KB - Virtual size: 59KB

/57 Size: 58KB - Virtual size: 57KB

/70 Size: 10KB - Virtual size: 10KB

/81 Size: 137KB - Virtual size: 137KB

/92 Size: 1024B - Virtual size: 640B

.text
Size: 416KB - Virtual size: 416KB

.data
Size: 13KB - Virtual size: 13KB

.rdata
Size: 68KB - Virtual size: 67KB

.pdata
Size: 17KB - Virtual size: 17KB

.xdata
Size: 15KB - Virtual size: 15KB

.bss
Size: - Virtual size: 27KB

.idata
Size: 11KB - Virtual size: 11KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 72B

/4
Size: 1KB - Virtual size: 1KB

/19
Size: 495KB - Virtual size: 494KB

/31
Size: 19KB - Virtual size: 19KB

/45
Size: 59KB - Virtual size: 59KB

/57
Size: 58KB - Virtual size: 57KB

/70
Size: 10KB - Virtual size: 10KB

/81
Size: 137KB - Virtual size: 137KB

/92
Size: 1024B - Virtual size: 640B