22e14b979963edaa15e9cd9a6afff237

Sharing

Copy URL

Twitter E-mail

General

Target

22e14b979963edaa15e9cd9a6afff237
Size

433KB
MD5

22e14b979963edaa15e9cd9a6afff237
SHA1

d4da1d494bac9d75f46e8a59a63508cb4b768c4a
SHA256

0178c1ea8ecc72708512aaeb8c068b6f17f01ec31995cd2f3c413d0f4ec833ff
SHA512

a3e1ff02abb1ada44065bea0900bd6953f5855cbcc8820c80b48d254270fe6baa2a0e6808c633ef5d3b1ed62843341bf36accf7f6e2082cf3f041c6e7009624f
SSDEEP

6144:0iQVZjfYVZ0I3NJU83KXy0mQcu+ieX9oobon/Jt26zrCLYTwl9X1jLsv95YoC0e8:LQVtwBUtCrbjooEn/326iLgw1Lm6bRn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22e14b979963edaa15e9cd9a6afff237

Files

22e14b979963edaa15e9cd9a6afff237
.exe windows:6 windows x64 arch:x64

322f1c1ff4870ee88af8af80b98138a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mswsock

GetAcceptExSockaddrs
AcceptEx

ole32

CoUninitialize
CoInitializeEx

ws2_32

ntohs
bind
WSAGetOverlappedResult
WSAStartup
closesocket
WSARecv
WSASend
WSAAddressToStringA
htons
listen
htonl
WSACleanup
select
recv
WSASocketW
WSAGetLastError
inet_ntoa
setsockopt

mscoree

ClrCreateManagedInstance

webengine4

GetXSPHeap
LoadLibraryUsingFullPath
AttachHandleToThreadPool
XspLogEvent
InitializeLibrary
PrintResourceString
PerfCounterInitialize
AspnetLoadResourceDLL

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW

kernel32

InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetProcessAffinityMask
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
RtlCaptureContext
GetVersionExW
GetSystemDirectoryW
HeapReAlloc
WideCharToMultiByte
FileTimeToSystemTime
lstrlenW
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
LoadLibraryW
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
MultiByteToWideChar
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
FreeLibrary
GetProcAddress
SetEvent
WaitForSingleObject
GetSystemInfo
CloseHandle
CreateEventW
SetWaitableTimer
Sleep
CreateThread
FormatMessageW
CreateWaitableTimerW
SetConsoleCtrlHandler
GetLastError
SwitchToThread

vcruntime140_clr0400

strchr
_purecall
memset
__C_specific_handler
memcpy
strstr

ucrtbase_clr0400

_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_itoa_s
wcsncpy_s
wcscpy_s
__stdio_common_vswprintf
strtol
_seh_filter_exe
strncmp
__p__commode
__setusermatherr

Exports

Exports

STWNDCloseConnection
STWNDDeleteStateItem
STWNDEndOfRequest
STWNDGetLocalAddress
STWNDGetLocalPort
STWNDGetRemoteAddress
STWNDGetRemotePort
STWNDIsClientConnected
STWNDSendResponse

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 396KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

322f1c1ff4870ee88af8af80b98138a2

Headers

DLL Characteristics

File Characteristics

Imports

mswsock

ole32

ws2_32

mscoree

webengine4

advapi32

kernel32

vcruntime140_clr0400

ucrtbase_clr0400

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 6KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 396KB - Virtual size: 736KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 6KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 396KB - Virtual size: 736KB