dummped_from_0000021062020000[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dummped_from_0000021062020000.exe
Size

166KB
MD5

ab7cfec6701120193e3bbc9786b956fa
SHA1

fea2d4199c287174a7aa3ce4191d4e47524e8c99
SHA256

dd4c75521623ea10afebb3795cdccb01b16bb0c992bb9bab7c76428faac6e616
SHA512

e8c511b6b697daf8c2cca148b36d6c1f4e5b920cd536862eff071bd5d11eae923ed382bacf24d526486e4c711b7e10d706b2aee9726df2c7eeec4d7871a83aa9
SSDEEP

3072:zixYRIgVFK9cJx2I87ZMGCDaZqZu9E/gwAE/dxwtJBdw:zixYVVQ9G2I8ZMGjZqY9EhAWUB6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dummped_from_0000021062020000.exe

Files

dummped_from_0000021062020000.exe
.exe windows:6 windows x64 arch:x64

a28c12e8a4434cbcb5b5a15bbbf3a0c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

strcmp
_snprintf
_errno
memset
_vsnprintf
_strtoi64
memchr
_time64
strncpy
strchr
strtod
localeconv
_vsnwprintf
qsort
atol
memcpy

kernel32

FindNextFileW
GetTickCount
SetThreadPriority
FlushFileBuffers
LocalAlloc
GetExitCodeProcess
GetFileAttributesW
MultiByteToWideChar
SetCurrentDirectoryA
Sleep
lstrcmpiW
GetDriveTypeW
GetLastError
CreateDirectoryW
lstrcatA
lstrcmpA
CreateMutexW
GetCurrentThread
GetProcessId
GetNumberFormatA
DisconnectNamedPipe
MoveFileW
ExitThread
K32GetModuleFileNameExW
GetCurrentProcessId
SwitchToThread
GetModuleHandleA
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
LoadLibraryA
GetCurrentProcess
lstrcatW
WideCharToMultiByte
FindFirstFileW
GetSystemTimeAsFileTime
SetFileAttributesW
lstrlenW
LoadLibraryW
FreeLibrary
GetCommandLineW
GetVersionExA
GetSystemInfo
GetCurrentDirectoryW
GetWindowsDirectoryW

user32

CharUpperBuffA
CharUpperBuffW

shell32

CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

SafeArrayGetLBound
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayDestroy
VariantClear
SysFreeString
SysAllocString

Exports

Exports

hvsi

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a28c12e8a4434cbcb5b5a15bbbf3a0c7

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 126KB - Virtual size: 125KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 14KB

.pdata Size: 5KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 68B

.text
Size: 126KB - Virtual size: 125KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 14KB

.pdata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 68B