170932512f51d1ddf6d1263164633836

Sharing

Copy URL

Twitter E-mail

General

Target

170932512f51d1ddf6d1263164633836
Size

93KB
MD5

170932512f51d1ddf6d1263164633836
SHA1

6e2bc24abe5a9153eb4d2d406de8c44d36e1d5b1
SHA256

4fb455736cb4be62d7ac55442a435ff91e96af43c3f40c5914ed60f493e72f0a
SHA512

7d7eccec40d8205067636b668e1cd283299839e8e28414f24a6ec591d8a9952e6a4b7e2dcba4e6f8fb6fba9ed4846ab3d47feced1ac9569df2e6242a68a685c8
SSDEEP

1536:5RXCdnNjueWk4saVmFglKVVvIoS77rbeo5FtYS+vFoNluqjiHlrvBS0xeLpvh:5RSLjutUgK7IoSrbedeNM55ALp5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/xxx.exe

Files

170932512f51d1ddf6d1263164633836
.rar
xxx.exe
.exe windows:6 windows x64 arch:x64

53146cac95e515e40608573f7cbce870

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetConsoleScreenBufferSize
SetConsoleTitleA
SetCurrentConsoleFontEx
GetConsoleWindow
CloseHandle
GetLastError
SetConsoleTextAttribute
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
GetStdHandle
CreateEventW
GetModuleHandleW
SetPriorityClass
CreateThread
GetCurrentProcess
Sleep
GetConsoleScreenBufferInfo
GetProcAddress
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
QueryPerformanceFrequency
WaitForSingleObjectEx
QueryPerformanceCounter

user32

GetDesktopWindow
SetWindowLongA
GetWindowLongA
GetAsyncKeyState
GetWindowRect
SetWindowPos
MoveWindow
mouse_event
SetLayeredWindowAttributes

advapi32

ConvertSidToStringSidA
IsValidSid
GetTokenInformation
OpenProcessToken

shell32

ShellExecuteA

msvcp140

_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?uncaught_exceptions@std@@YAHXZ
?_Random_device@std@@YAIXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
_Xtime_get_ticks
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

winhttp

WinHttpReadData
WinHttpCloseHandle
WinHttpSendRequest
WinHttpOpen
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpQueryDataAvailable

vcruntime140

__std_type_info_compare
__std_type_info_name
__std_exception_destroy
__std_exception_copy
__std_terminate
memset
__current_exception_context
__current_exception
__RTDynamicCast
_purecall
strchr
__CxxFrameHandler3
memmove
_CxxThrowException
memcpy
memcmp
memchr
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

__p___argv
_c_exit
__p___argc
_exit
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
terminate
_errno
_invalid_parameter_noinfo
system
exit
_get_initial_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc
free
_aligned_malloc
_set_new_mode
_callnewh
_aligned_free

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53146cac95e515e40608573f7cbce870

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

winhttp

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 188KB - Virtual size: 188KB

.rdata Size: 75KB - Virtual size: 75KB

.data Size: 11KB - Virtual size: 21KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 188KB - Virtual size: 188KB

.rdata
Size: 75KB - Virtual size: 75KB

.data
Size: 11KB - Virtual size: 21KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 3KB - Virtual size: 3KB