4b60e9b63a0563d7c7f240620ca4ab06

Sharing

Copy URL

Twitter E-mail

General

Target

4b60e9b63a0563d7c7f240620ca4ab06
Size

1.6MB
MD5

4b60e9b63a0563d7c7f240620ca4ab06
SHA1

2f7d729826d4ad1c136729cd2eaa804dfb1e7a01
SHA256

430736b1bf70cdd9c5434674779f42e637b2f2362ae83d94ac310ac37655842b
SHA512

d3e66a9bc4ff65aeb21ed8e5012f145dd6fe650a976222ae5e2f3286a2e320511850ead4aa82115f0b5addf169e34a82ffaee8545fd004a7da5c43562792782c
SSDEEP

24576:EjcslMGn3B1Y76wx4g6csiVrldKxP85/u/okyWuF:EgslMGn3B1Y76wx4gEP09F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b60e9b63a0563d7c7f240620ca4ab06

Files

4b60e9b63a0563d7c7f240620ca4ab06
.exe windows:10 windows x64 arch:x64

bf8ca776fcd758066a7b45aadc6b7f37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_commode
_fmode
__C_specific_handler
_initterm
?terminate@@YAXXZ
__setusermatherr
_cexit
_exit
??_V@YAXPEAX@Z
_vsnwprintf
exit
__set_app_type
__wgetmainargs
_amsg_exit
memcpy_s
_XcptFilter
_wcsicmp
sprintf
_vsnprintf_s
??8type_info@@QEBAHAEBV0@@Z
realloc
wcscpy_s
__CxxFrameHandler3
swprintf_s
_lock
memcmp
_unlock
free
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
__dllonexit
_onexit
_snwprintf_s
_callnewh
_vsnwprintf_s
??1type_info@@UEAA@XZ
malloc
wprintf_s
_purecall
??3@YAXPEAX@Z
memmove_s
memset

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-libraryloader-l1-2-0

RemoveDllDirectory
GetModuleHandleW
AddDllDirectory
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
FreeLibrary
LoadStringW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
OpenProcessToken
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
DeleteService
CreateServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize
RoActivateInstance

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
EnterCriticalSection
SetEvent
LeaveCriticalSection
ReleaseSRWLockShared
WaitForSingleObject
CreateSemaphoreExW
DeleteCriticalSection
InitializeCriticalSectionEx
ReleaseSemaphore
InitializeSRWLock
ReleaseMutex
ReleaseSRWLockExclusive
ResetEvent
WaitForSingleObjectEx
OpenSemaphoreW
AcquireSRWLockExclusive
CreateEventExW
CreateMutexExW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegNotifyChangeKeyValue
RegCloseKey
RegGetValueW
RegEnumKeyExW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W
QueryServiceStatusEx

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo
RoTransformError

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateInstance
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoTaskMemFree

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

ntdll

RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull
WindowsDuplicateString
WindowsIsStringEmpty
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-security-base-l1-1-0

FreeSid
DuplicateToken
AllocateAndInitializeSid
GetTokenInformation
CheckTokenMembership

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
CancelThreadpoolIo
CloseThreadpool
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
SetThreadpoolThreadMaximum
CreateThreadpoolWait
CreateThreadpoolWork
SetThreadpoolWait
SubmitThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
StartThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolIo
CreateThreadpool
WaitForThreadpoolIoCallbacks

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe
CreateNamedPipeW

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-file-l1-1-0

WriteFile
ReadFile

api-ms-win-core-kernel32-legacy-l1-1-0

GetNamedPipeClientProcessId

Sections

.text
Size: 843KB - Virtual size: 843KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 396KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf8ca776fcd758066a7b45aadc6b7f37

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

ntdll

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-registry-l1-1-1

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

Sections

.text Size: 843KB - Virtual size: 843KB

.rdata Size: 340KB - Virtual size: 340KB

.data Size: 6KB - Virtual size: 69KB

.pdata Size: 37KB - Virtual size: 37KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 396KB - Virtual size: 736KB

.text
Size: 843KB - Virtual size: 843KB

.rdata
Size: 340KB - Virtual size: 340KB

.data
Size: 6KB - Virtual size: 69KB

.pdata
Size: 37KB - Virtual size: 37KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 396KB - Virtual size: 736KB