86767e97ff493d7bcf5524bca5e91abc5e5f971d76a63e488ad4a75eb59a7c11[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

86767e97ff493d7bcf5524bca5e91abc5e5f971d76a63e488ad4a75eb59a7c11.exe
Size

190KB
MD5

76d3edbc8682ab76f42369d30c900f60
SHA1

680ec21efed1308e37d18f41de8d347fc09d23de
SHA256

86767e97ff493d7bcf5524bca5e91abc5e5f971d76a63e488ad4a75eb59a7c11
SHA512

05d56898751698098b55e4abc6cee3bc8d4c302915e120f33a13ebca3c39f9789b4bfef1320f287b583e593f47f8e023905602f7f5d6926fbdbffee72ed4097a
SSDEEP

3072:zlaWTbMeUWIW1PDA+Z6d2idpVAh58DH/KYLVA3w6jVcZjp:zlaWHMeFcL2idpVAhiJJGw6w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86767e97ff493d7bcf5524bca5e91abc5e5f971d76a63e488ad4a75eb59a7c11.exe

Files

86767e97ff493d7bcf5524bca5e91abc5e5f971d76a63e488ad4a75eb59a7c11.exe
.exe windows:6 windows x64 arch:x64

363ae59c346b7b6f83691bab6d7731f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetUserNameW

kernel32

GetLastError
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
ReleaseMutex
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCurrentProcess
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
GetStdHandle
GetCurrentProcessId
WaitForSingleObject
QueryPerformanceCounter
TryAcquireSRWLockExclusive
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetConsoleMode
WriteConsoleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
IsProcessorFeaturePresent

shell32

ShellExecuteW

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memcmp
memmove
memset
__CxxFrameHandler3
memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_initterm
_seh_filter_exe
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
_exit
_configure_narrow_argv
exit
_initialize_narrow_environment
_set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

363ae59c346b7b6f83691bab6d7731f6

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

shell32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 124KB - Virtual size: 124KB

.rdata Size: 58KB - Virtual size: 57KB

.data Size: 512B - Virtual size: 760B

.pdata Size: 5KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 948B

.text
Size: 124KB - Virtual size: 124KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 512B - Virtual size: 760B

.pdata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 948B