908040ddf4675b6a559d1de36eb98c80

Sharing

Copy URL Twitter E-mail

General

Target

908040ddf4675b6a559d1de36eb98c80
Size

846KB
MD5

908040ddf4675b6a559d1de36eb98c80
SHA1

445f47dcb7a5e7b13473ce141e179994fef784f7
SHA256

3bcb64bfe4d69efafea06053569ad4fe0c38979a2372a344c48171fe2acbb0c4
SHA512

1e35475a59620d259ca21cd0ecfb550a93fba81ea5caf285fb69fa9079a6f48865211efc2b0a7d7a870e57ea95fac7f329124b1a5814d5e3e70525dd6b0b341f
SSDEEP

24576:Vs40ZGlnzpNOnRZIfC3wsuGKFzFTSpkPfneG68q:Vs45nzpNOnRZmFTFfneG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
908040ddf4675b6a559d1de36eb98c80

Files

908040ddf4675b6a559d1de36eb98c80
.exe windows:6 windows x64 arch:x64

44314f9353470a1d957cc8ed491e97ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateFileW
OpenProcess
GetLastError
DeleteFileW
CloseHandle
CreateThread
GetWindowsDirectoryW
GetConsoleWindow
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
VirtualFreeEx
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualQueryEx
InitializeSListHead
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WriteFile
QueryPerformanceCounter
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
ExitProcess
OutputDebugStringA
ReadProcessMemory
GetSystemTimeAsFileTime
Sleep

user32

GetWindowLongW
SetWindowLongW
GetClassNameA
DispatchMessageW
PeekMessageW
EnumWindows
SetCursorPos
SetForegroundWindow
IsIconic
GetWindowTextW
GetKeyState
ScreenToClient
GetCapture
TranslateMessage
ReleaseCapture
GetClientRect
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
ClientToScreen
IsChild
GetClipboardData
SetClipboardData
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
DefWindowProcW
FindWindowExW
GetWindowRect
CreateWindowExW
RegisterClassExW
ShowWindow
SetLayeredWindowAttributes
FindWindowW
GetAsyncKeyState
mouse_event

advapi32

DeleteService
CloseServiceHandle
OpenSCManagerA
OpenServiceA
ControlService

shell32

ShellExecuteW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

d3dx11_43

D3DX11CompileFromMemory

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
memcmp
__current_exception
strstr
__std_terminate
__std_exception_destroy
__std_exception_copy
memmove
memcpy
memchr
memset
_CxxThrowException
__current_exception_context

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode
_callnewh

api-ms-win-crt-runtime-l1-1-0

_exit
_initterm
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
system
_set_app_type
_seh_filter_exe
terminate
_cexit
_register_onexit_function
_initialize_onexit_table
exit
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initterm_e
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

fwrite
_wfopen
ftell
fflush
__p__commode
_set_fmode
__stdio_common_vsprintf
fseek
fclose
fread
__stdio_common_vsscanf

api-ms-win-crt-string-l1-1-0

_wcsicmp
strcmp
strncpy

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

sinf
powf
acosf
sqrt
cosf
fmodf
pow
floorf
__setusermatherr
ceilf
sqrtf
atan2f

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 326KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44314f9353470a1d957cc8ed491e97ae

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

dwmapi

d3d11

d3dcompiler_47

d3dx11_43

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 399KB - Virtual size: 399KB

.rdata Size: 326KB - Virtual size: 325KB

.data Size: 104KB - Virtual size: 106KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 280B

.text
Size: 399KB - Virtual size: 399KB

.rdata
Size: 326KB - Virtual size: 325KB

.data
Size: 104KB - Virtual size: 106KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 280B