90e14193961070b3e275de3626f637f1f1e6108ff0d8ee68830b125f242358c3

Sharing

Copy URL Twitter E-mail

General

Target

90e14193961070b3e275de3626f637f1f1e6108ff0d8ee68830b125f242358c3
Size

5.8MB
MD5

dba5fa2aed1bcb241cfbf9ee87e47cd5
SHA1

8494547b5dfb250b021e092b6bbd173dbb775ae7
SHA256

90e14193961070b3e275de3626f637f1f1e6108ff0d8ee68830b125f242358c3
SHA512

2f55db12f5e1efc9a0601b9f1dfd814ecf4cc2e301d4efb7cba6b4d5f4df0e7a2e50a90ab612dd1f953d14928f115992a2328ec2af5fe26548b2200bc3f1f8b3
SSDEEP

98304:UCopzsdgdCi1GIpiyPJsMnsaoUM6FMBxC:UPPnTJsMnZw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
90e14193961070b3e275de3626f637f1f1e6108ff0d8ee68830b125f242358c3

Files

90e14193961070b3e275de3626f637f1f1e6108ff0d8ee68830b125f242358c3
.dll windows:6 windows x64 arch:x64

4cd000a168d60f5f3748aec475938a5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

flock

?Output@Pipeline@Flock@Kestrel@@QEAAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVValue@Keson@3@@Z
?Input@Pipeline@Flock@Kestrel@@QEAAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVValue@Keson@3@@Z
?Stop@Pipeline@Flock@Kestrel@@QEAAHXZ
?Start@Pipeline@Flock@Kestrel@@QEAAHXZ
?Release@Pipeline@Flock@Kestrel@@QEAAXXZ
?Init@Pipeline@Flock@Kestrel@@QEAAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1Pipeline@Flock@Kestrel@@QEAA@XZ
??0Pipeline@Flock@Kestrel@@QEAA@XZ
?input@_channel@@QEAA_NPEBX@Z
??0_channel@@QEAA@_K0AEBV?$function@$$A6AXPEAX@Z@std@@1AEBV?$function@$$A6AXPEAXPEBX@Z@2@@Z
??1_channel@@QEAA@XZ
?output@_channel@@QEAA_NPEAX@Z
?Init@ModuleEnv@Flock@Kestrel@@SAXXZ

kestrel

kestrel_frame_upload
kestrel_error_info
kestrel_frame_make
kestrel_device_bind
kestrel_frame_ref
kestrel_bson_get_ext_type
kestrel_deinit
kestrel_frame_plane
kestrel_frame_size
kestrel_frame_video_width
kestrel_frame_video_format
kestrel_frame_video_height
kestrel_frame_video_stride
kestrel_frame_plane_num
kestrel_frame_download
kestrel_bson_get_ext_data
kestrel_bson_create_ext_data
kestrel_bson_is_ext_data
kestrel_init
kestrel_frame_free
kestrel_frame_mem_type

kestrel_aux

kestrel_frame_load

kestrel_log

kestrel_log
kestrel_log_set_callback
kestrel_log_reset_callback

kestrel_bson

kestrel_bson_create_int32
kestrel_bson_duplicate
kestrel_bson_create_array
kestrel_bson_get_document_item
kestrel_bson_type
kestrel_bson_add_array_item
kestrel_bson_detach_document_item
kestrel_bson_delete_document_item
kestrel_bson_child_number
kestrel_bson_get_array_item
kestrel_bson_has_document_item
kestrel_bson_get_int32
kestrel_bson_get_string
kestrel_bson_create_null
kestrel_bson_replace_document_item
kestrel_bson_create_document
kestrel_io_create
kestrel_bson_get_int64
kestrel_bson_to_json_string
kestrel_io_destroy
kestrel_bson_add_document_item
kestrel_bson_decode
kestrel_bson_create_boolean
kestrel_bson_create_string
kestrel_bson_encode_to_data
kestrel_bson_delete

kestrel_core

kestrel_license_add

kestrel_os_compat

kestrel_clock_nanosec
kestrel_thread_id

opencv_world460

??0Mat@cv@@QEAA@HHH@Z
??0Mat@cv@@QEAA@AEBV01@@Z
??0Mat@cv@@QEAA@$$QEAV01@@Z
?cvtColor@cv@@YAXAEBV_InputArray@1@AEBV_OutputArray@1@HH@Z
??1Mat@cv@@QEAA@XZ
?empty@Mat@cv@@QEBA_NXZ
?imwrite@cv@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV_InputArray@1@AEBV?$vector@HV?$allocator@H@std@@@3@@Z

gokey

GenerateKey

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

kernel32

SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
FindClose
GetCurrentDirectoryW
GetFileAttributesExW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
GetFileType
GetStdHandle
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ExitProcess
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
GetModuleHandleW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
LCMapStringEx
DecodePointer
GetFullPathNameA
GetCurrentThreadId
GetTimeZoneInformation
TerminateThread
CloseHandle
GetCurrentProcess
SetStdHandle
FindFirstFileW
GetModuleFileNameA
HeapFree
CreateSemaphoreA
GetComputerNameExW
SwitchToFiber
GetProcessTimes
FindNextFileA
SetThreadPriority
DefineDosDeviceA
SearchPathA
FindFirstFileA
CreateProcessW
GetVersionExA
Sleep
SetEvent
GetProcAddress
TerminateProcess
GetLogicalDrives
DeleteFileW
ReleaseSemaphore
TlsGetValue
WideCharToMultiByte
GetModuleFileNameW
GetComputerNameW
CreateFileA
GetModuleHandleA
QueryPerformanceCounter
CreateFileW
OpenProcess
EnterCriticalSection
CreateFileMappingA
MapViewOfFile
WaitForSingleObject
QueryDosDeviceA
OutputDebugStringA
SetFileAttributesW
ReadFile
ResumeThread
CreateThread
FlushFileBuffers
LoadLibraryExA
TlsAlloc
GetVersion
FindNextFileW
GetLastError
CreateDirectoryW
InitializeCriticalSection
GetVolumeInformationA
GetExitCodeThread
LocalAlloc
UnmapViewOfFile
CreateEventA
GetSystemTime
DeleteCriticalSection
SetLastError
FreeLibrary
HeapAlloc
OpenSemaphoreA
RtlUnwind
DeleteFiber
QueryPerformanceFrequency
RemoveDirectoryW
MultiByteToWideChar
SetFilePointerEx
GetSystemInfo
ReleaseMutex
GetWindowsDirectoryA
WriteFile
GetTickCount
GetProcessHeap
ConvertThreadToFiber
SetErrorMode
GetFileInformationByHandle
TlsSetValue
HeapReAlloc
GetSystemDirectoryA
GetLocalTime
GetFileSize
OpenMutexA
DuplicateHandle
GetEnvironmentVariableW
LocalFree
LeaveCriticalSection
GetEnvironmentVariableA
GetDriveTypeA
CreateMutexA
MoveFileExW
DeviceIoControl
SystemTimeToFileTime
SwitchToThread
GetSystemTimeAsFileTime
EncodePointer
HeapSize
WriteConsoleW
GetCurrentProcessId
SetEndOfFile
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObjectEx
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock

wsock32

WSAStartup

Exports

Exports

??0ARC4@@QEAA@XZ
?base64_decode@@YA?AV?$vector@EV?$allocator@E@std@@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?base64_encode@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBEI@Z
?encrypt@ARC4@@QEAAXPEAD0H@Z
?encrypt@ARC4@@QEAAXPEAE0H@Z
?setKey@ARC4@@QEAAXPEAEH@Z
c_spm_create
c_spm_error_info
c_spm_free_image
c_spm_free_result
c_spm_inference
c_spm_init
c_spm_read_image
c_spm_release
c_spm_runner_update_segmentation_option
c_spm_runtime_status
c_spm_set_batch_num
c_spm_set_gpu
c_spm_set_return_mask
c_spm_set_save_mask
c_spm_set_workers_per_gpu

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 275KB - Virtual size: 647KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.llvm_ad
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4cd000a168d60f5f3748aec475938a5c

Headers

DLL Characteristics

File Characteristics

Imports

flock

kestrel

kestrel_aux

kestrel_log

kestrel_bson

kestrel_core

kestrel_os_compat

opencv_world460

gokey

rpcrt4

kernel32

wsock32

Exports

Exports

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 275KB - Virtual size: 647KB

.pdata Size: 76KB - Virtual size: 76KB

.llvm_ad Size: 2KB - Virtual size: 1KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 275KB - Virtual size: 647KB

.pdata
Size: 76KB - Virtual size: 76KB

.llvm_ad
Size: 2KB - Virtual size: 1KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 9KB - Virtual size: 9KB