fa5c9f12430c047ff95c04dce5a1aeab1c058f84d1fd5d1b68411ef71e789703

Sharing

Copy URL

Twitter E-mail

General

Target

fa5c9f12430c047ff95c04dce5a1aeab1c058f84d1fd5d1b68411ef71e789703
Size

366KB
MD5

cd2a65eebc3e4029d99ffccf0679c25a
SHA1

29fb956705a4f90035c6a20ae2f91947e8a0b78f
SHA256

fa5c9f12430c047ff95c04dce5a1aeab1c058f84d1fd5d1b68411ef71e789703
SHA512

2ead65dafa1e7908a2851a62adf85f532355951e517b364b9ce3e13f7b2a4bdeaa9e4e50402ad93aaae4470bb0cfff6c4f8d112a8c0ea777e76683599a62be47
SSDEEP

6144:8K7R3G0GsOl18b8uk+f0dpFYC2QxqXY0vWwoF1QzDdyQdRu15DdQYImG:8KxGMOukI0dpFIQxqdWPQbdR0xRG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa5c9f12430c047ff95c04dce5a1aeab1c058f84d1fd5d1b68411ef71e789703

Files

fa5c9f12430c047ff95c04dce5a1aeab1c058f84d1fd5d1b68411ef71e789703
.dll windows:6 windows x64 arch:x64

6aa163b3189782b460c6e44dae9a4da8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

hlog

ord27

beebase

?Base64Encode@Encrypt@Base@Bee@@YA_NAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV45@@Z
?str_fmt@StringUtil@Base@Bee@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDZZ

kernel32

UnhandledExceptionFilter
SetEvent
CloseHandle
CreateEventA
GetProcessHeap
HeapFree
WaitForSingleObjectEx
GetDiskFreeSpaceExA
GetDriveTypeA
CreateFileA
GetLastError
SetFilePointer
WriteFile
GetFileSizeEx
SetEndOfFile
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
DuplicateHandle
GetCurrentProcess
CreateSemaphoreA
HeapAlloc
GetProcAddress
GetModuleHandleW
DeviceIoControl
RemoveDirectoryW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetStringTypeExA
GetUserDefaultLCID
LCMapStringA
LoadLibraryA
FreeLibrary
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FindClose
CreateEventW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateWaitableTimerA
GetModuleHandleA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetCurrentThreadId
GetCurrentProcessId
Sleep
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx
ResetEvent
LocalFree
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
AreFileApisANSI
CreateDirectoryW
CreateFileW

msvcp140

?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Incref@facet@locale@std@@UEAAXXZ

vcruntime140

__CxxFrameHandler3
__std_terminate
memmove
_CxxThrowException
_purecall
memcpy
memset
memcmp
__std_type_info_compare
__std_exception_copy
memchr
__RTDynamicCast
__C_specific_handler
__vcrt_InitializeCriticalSectionEx
__std_type_info_destroy_list
__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_beginthreadex
_initterm_e
_initterm
strerror
terminate
_cexit
_errno
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vsprintf_s
fopen
fclose
fseek
fread
_ftelli64
_fseeki64

api-ms-win-crt-convert-l1-1-0

_atoi64

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

user32

LoadStringA

Exports

Exports

??0CFileStorage@file_storage@Bee@@QEAA@AEBV012@@Z
??0CFileStorage@file_storage@Bee@@QEAA@XZ
??0CFileStorageParam@file_storage@Bee@@QEAA@$$QEAV012@@Z
??0CFileStorageParam@file_storage@Bee@@QEAA@AEBUFileStorageParam@12@@Z
??0CFileStorageParam@file_storage@Bee@@QEAA@AEBV012@@Z
??0CFileStorageParam@file_storage@Bee@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N_K12@Z
??0CFileStorageParam@file_storage@Bee@@QEAA@XZ
??0CStorageBase@file_storage@Bee@@QEAA@AEBV012@@Z
??0CStorageBase@file_storage@Bee@@QEAA@XZ
??1CFileStorage@file_storage@Bee@@UEAA@XZ
??1CFileStorageParam@file_storage@Bee@@QEAA@XZ
??1CStorageBase@file_storage@Bee@@UEAA@XZ
??4CFileStorage@file_storage@Bee@@QEAAAEAV012@AEBV012@@Z
??4CFileStorageParam@file_storage@Bee@@QEAAAEAV012@$$QEAV012@@Z
??4CFileStorageParam@file_storage@Bee@@QEAAAEAV012@AEBV012@@Z
??4CStorageBase@file_storage@Bee@@QEAAAEAV012@AEBV012@@Z
??_7CFileStorage@file_storage@Bee@@6B@
??_7CStorageBase@file_storage@Bee@@6B@
?Apply@CFileStorage@file_storage@Bee@@QEAAPEAVCStorageBase@23@AEBUFSParam@23@@Z
?ApplyV2@CFileStorage@file_storage@Bee@@QEAA?AV?$shared_ptr@VCStorageBase@file_storage@Bee@@@std@@V?$shared_ptr@VCFileStorageParam@file_storage@Bee@@@5@@Z
?Free@CFileStorage@file_storage@Bee@@QEAA_NPEAVCStorageBase@23@@Z
?GetDiskPartition@CFileStorageParam@file_storage@Bee@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetEnableLimit@CFileStorageParam@file_storage@Bee@@QEAA_NXZ
?GetLimit@CFileStorageParam@file_storage@Bee@@QEAA_KXZ
?GetLoopRecover@CFileStorageParam@file_storage@Bee@@QEAA_NXZ
?GetRemainSpace@CFileStorageParam@file_storage@Bee@@QEAA_NAEA_KW4DiskSpaceType@23@@Z
?GetRemainingSpace@CFileStorageParam@file_storage@Bee@@QEAA_KXZ
?GetRetain@CFileStorageParam@file_storage@Bee@@QEAA_KXZ
?GetRootDir@CFileStorageParam@file_storage@Bee@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?IsResourceExist@file_storage@Bee@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetDiskPartition@CFileStorageParam@file_storage@Bee@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetEnableLimit@CFileStorageParam@file_storage@Bee@@QEAAX_N@Z
?SetLimit@CFileStorageParam@file_storage@Bee@@QEAAX_K@Z
?SetLoopRecover@CFileStorageParam@file_storage@Bee@@QEAAX_N@Z
?SetRetain@CFileStorageParam@file_storage@Bee@@QEAAX_K@Z
?SetRootDir@CFileStorageParam@file_storage@Bee@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?__autoclassinit2@CFileStorageParam@file_storage@Bee@@QEAAX_K@Z

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6aa163b3189782b460c6e44dae9a4da8

Headers

DLL Characteristics

File Characteristics

Imports

hlog

beebase

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

user32

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 235KB

.rdata Size: 103KB - Virtual size: 102KB

.data Size: 8KB - Virtual size: 10KB

.pdata Size: 13KB - Virtual size: 12KB

.gfids Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 236KB - Virtual size: 235KB

.rdata
Size: 103KB - Virtual size: 102KB

.data
Size: 8KB - Virtual size: 10KB

.pdata
Size: 13KB - Virtual size: 12KB

.gfids
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB