449d06b24ebe397b2b8953a25dcda3ec

Sharing

Copy URL Twitter E-mail

General

Target

449d06b24ebe397b2b8953a25dcda3ec
Size

1.8MB
MD5

449d06b24ebe397b2b8953a25dcda3ec
SHA1

3876a4eeef99476c10552b5fccff95785ae48b79
SHA256

aa542ca06d9459dff6f107613b8949956cee57b42bbdc69a601b13239c0270f7
SHA512

0a598ba0ca3fe4fa8b4ab01b43816e96a4242e67778e5458661d5dc2f4924771c2fa6b9277d728c1013dac15048ca7f2ffa53cc468117e6f18224b3d7c16985f
SSDEEP

24576:zFnNSS7SIfKLQHJ2ochrLlqMoy6nV925+P7IBeDxRuGrSncTyDjcE2M+WKnlPkwx:bXS5QH8om/lqMoy6nV99P1kSQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
449d06b24ebe397b2b8953a25dcda3ec

Files

449d06b24ebe397b2b8953a25dcda3ec
.exe windows:10 windows x64 arch:x64

bc4180ead977aaf92baa2185cc3d84e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

iswdigit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
?what@exception@@UEBAPEBDXZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
wcsstr
__dllonexit
qsort
_onexit
wcsrchr
wcstok
_errno
_beginthreadex
_vsnprintf
memset
wcsncmp
_wcsicmp
_wcsnicmp
_purecall
wcscat_s
_vsnprintf_s
malloc
realloc
free
??0exception@@QEAA@XZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
iswspace
towupper
memmove
memcpy
memcmp
_vscwprintf
wcstoul
wcscmp
??1exception@@UEAA@XZ
_vsnwprintf
__C_specific_handler
__CxxFrameHandler3

oleaut32

VariantInit
VariantCopy
VariantClear
SysAllocStringLen
VarUI4FromStr
LoadRegTypeLi
SysStringLen
GetErrorInfo
SysAllocString
SysFreeString
VariantChangeType

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-1-0

CreateMutexExW
CancelWaitableTimer
SetWaitableTimer
LeaveCriticalSection
SetEvent
InitializeCriticalSectionAndSpinCount
CreateEventW
WaitForSingleObjectEx
CreateWaitableTimerExW
EnterCriticalSection
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSection
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjectsEx
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
OpenThread
ResumeThread
OpenThreadToken
GetCurrentProcess
SetThreadPriority
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess
GetStartupInfoW
GetCurrentThread

api-ms-win-core-com-l1-1-0

CoGetObjectContext
CoSetProxyBlanket
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoDisconnectContext
CoTaskMemRealloc
CoRevertToSelf
CoImpersonateClient
CoCreateGuid
CLSIDFromString
CoGetClassObject
CoTaskMemAlloc
CoInitializeSecurity
CoInitializeEx
StringFromCLSID
CoFreeUnusedLibraries
CoUninitialize
CoCreateInstance

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount64
GetComputerNameExW
GetSystemInfo

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSetInformation
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
GetModuleFileNameA
GetProcAddress
LoadResource
LoadStringW
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
SizeofResource
FreeLibrary
GetModuleHandleW

api-ms-win-core-string-l2-1-0

CharNextW
CharPrevW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcpynW

ntdll

RtlNtStatusToDosError
RtlAdjustPrivilege
EtwTraceMessage
NtThawRegistry
NtFreezeRegistry
NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
NtThawTransactions
NtFreezeTransactions
NtQuerySystemInformation
RtlNtStatusToDosErrorNoTeb
NtQueryVolumeInformationFile
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

FindFirstVolumeW
FindNextVolumeW
FlushFileBuffers
GetDiskFreeSpaceW
FindFirstFileW
CreateDirectoryW
SetFileAttributesW
WriteFile
GetFileAttributesW
DeleteVolumeMountPointW
DeleteFileW
ReadFile
CreateFileW
DefineDosDeviceW
GetVolumeInformationW
FindNextFileW
FindClose
GetVolumePathNameW
QueryDosDeviceW
FindVolumeClose
GetDriveTypeW

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
FreeSid
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
PrivilegeCheck
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
CreateWellKnownSid
EqualSid
SetSecurityDescriptorOwner
CopySid
SetSecurityDescriptorGroup
GetAclInformation
GetAce
AddAce
AddAccessDeniedAceEx
AddAccessAllowedAceEx
IsValidSid
AccessCheck
GetSidSubAuthorityCount
EqualDomainSid
GetTokenInformation
InitializeSecurityDescriptor
AdjustTokenPrivileges

api-ms-win-core-kernel32-legacy-l1-1-1

SetVolumeMountPointW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

rpcrt4

I_RpcBindingInqLocalClientPID
UuidToStringW
RpcStringFreeW

devobj

DevObjEnumDeviceInfo
DevObjDestroyDeviceInfoList
DevObjUninstallDevice
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjGetDeviceRegistryProperty

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-service-private-l1-1-0

I_ScRegisterDeviceNotification
I_ScUnregisterDeviceNotification

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

vssapi

CreateWriterEx
VssFreeSnapshotPropertiesInternal
CreateVssSnapshotSetDescription
LoadVssSnapshotSetDescription
CreateWriter

vsstrace

ord2
ord4
ord7
ord5
ord11
ord1
ord10
ord9
ord3
ord6
ord8

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW
ReportEventW

authz

AuthzUnregisterSecurityEventSource
AuthzReportSecurityEventFromParams
AuthzRegisterSecurityEventSource

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

virtdisk

GetStorageDependencyInformation

bcd

BcdForciblyUnloadStore
BcdCloseObject
BcdGetElementData
BcdOpenSystemStore
BcdCloseStore
BcdOpenObject

api-ms-win-core-util-l1-1-0

EncodePointer

Sections

.text
Size: 950KB - Virtual size: 950KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 396KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc4180ead977aaf92baa2185cc3d84e3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

oleaut32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-eventing-provider-l1-1-0

rpcrt4

devobj

api-ms-win-core-file-l2-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

vssapi

vsstrace

api-ms-win-eventlog-legacy-l1-1-0

authz

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

virtdisk

bcd

api-ms-win-core-util-l1-1-0

Sections

.text Size: 950KB - Virtual size: 950KB

.rdata Size: 408KB - Virtual size: 408KB

.data Size: 1KB - Virtual size: 5KB

.pdata Size: 29KB - Virtual size: 28KB

.didat Size: 512B - Virtual size: 336B

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 396KB - Virtual size: 736KB

.text
Size: 950KB - Virtual size: 950KB

.rdata
Size: 408KB - Virtual size: 408KB

.data
Size: 1KB - Virtual size: 5KB

.pdata
Size: 29KB - Virtual size: 28KB

.didat
Size: 512B - Virtual size: 336B

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 396KB - Virtual size: 736KB