14b698568db1b6ee83d0179ff2c394d703d487a0d4e01aaf2c26e3151e5cec80

Sharing

Copy URL

Twitter E-mail

General

Target

14b698568db1b6ee83d0179ff2c394d703d487a0d4e01aaf2c26e3151e5cec80
Size

9.3MB
MD5

b3cf0f540971dcb63e6747a9a419e8d0
SHA1

ef3a4cde8d57877da7d66031185b7872c4680d73
SHA256

14b698568db1b6ee83d0179ff2c394d703d487a0d4e01aaf2c26e3151e5cec80
SHA512

bbffa1d1f609816b7a29322db088f7618b90a6c44d2f6b2ec48db6ba341a0cd57ac444fce3747afdd3b763d28fc5754b6ab1eed6b84d08e61b4ab2e26d080247
SSDEEP

196608:V5antZbkdEYka6V7LDkx3TyyaULlFfwwyZwx/6NBLWsCTfiYEfB+S:XanD40aarkpWy1fyZYyTZKREfp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14b698568db1b6ee83d0179ff2c394d703d487a0d4e01aaf2c26e3151e5cec80

Files

14b698568db1b6ee83d0179ff2c394d703d487a0d4e01aaf2c26e3151e5cec80
.exe windows:6 windows x64 arch:x64

ec9039d589da73c3cdc8d516a9dcff78

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
SizeofResource
FindFirstFileW
FindNextFileW
WriteFile
TerminateProcess
FindResourceA
FindClose
WaitForSingleObject
CreateFileW
SetFileAttributesW
Sleep
LockResource
WritePrivateProfileStringA
LoadResource
GetCurrentDirectoryW
WinExec
CreateProcessA
GetPrivateProfileStringA
GetTickCount
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
GetNativeSystemInfo
IsBadReadPtr
ExitProcess
LocalFree
FormatMessageA
GetLocaleInfoEx
FindFirstFileExW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetProcessHeap
GetFileInformationByHandleEx
GlobalLock
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
RtlUnwind
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ReadFile
LoadLibraryExW
TlsFree
TlsSetValue
DeleteCriticalSection
DecodePointer
HeapAlloc
CloseHandle
HeapReAlloc
GetLastError
MultiByteToWideChar
HeapSize
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
GetCurrentProcess
GlobalFree
GlobalAlloc
WideCharToMultiByte
GetModuleHandleW
HeapFree
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadIconA
SendMessageA
CreateWindowExA
RegisterClassExA
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
SetClipboardData
PostQuitMessage
ReleaseCapture
DispatchMessageA
DestroyWindow
GetSystemMetrics
ShowWindow
MessageBoxA
DefWindowProcA
TranslateMessage
PeekMessageA
UpdateWindow
MessageBoxTimeoutA
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

ws2_32

WSCInstallProvider
WSCEnumProtocols
WSCWriteProviderOrder
WSCDeinstallProvider

rpcrt4

UuidCreate

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile

wtsapi32

WTSSendMessageW

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

0
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

1
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec9039d589da73c3cdc8d516a9dcff78

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

d3d11

d3dcompiler_43

imm32

ws2_32

rpcrt4

wininet

wtsapi32

Sections

.text Size: 412KB - Virtual size: 411KB

.rdata Size: 131KB - Virtual size: 131KB

.data Size: 6KB - Virtual size: 13KB

.pdata Size: 15KB - Virtual size: 14KB

_RDATA Size: 512B - Virtual size: 500B

0 Size: 3.9MB - Virtual size: 3.9MB

1 Size: 2.4MB - Virtual size: 2.4MB

.reloc Size: 3KB - Virtual size: 3KB

.rsrc Size: 2.4MB - Virtual size: 2.4MB

.text
Size: 412KB - Virtual size: 411KB

.rdata
Size: 131KB - Virtual size: 131KB

.data
Size: 6KB - Virtual size: 13KB

.pdata
Size: 15KB - Virtual size: 14KB

_RDATA
Size: 512B - Virtual size: 500B

0
Size: 3.9MB - Virtual size: 3.9MB

1
Size: 2.4MB - Virtual size: 2.4MB

.reloc
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2.4MB - Virtual size: 2.4MB