5bc6866916618eb5090feb4d170a29b0

Sharing

Copy URL

Twitter E-mail

General

Target

5bc6866916618eb5090feb4d170a29b0
Size

705KB
MD5

5bc6866916618eb5090feb4d170a29b0
SHA1

7c1deddba70d5ea6c13c2d5b118ce333484800f3
SHA256

ba8a1667e1b5358bab2510a223e6857a2614b40360685203998909bbbe614771
SHA512

dac175fe4ab74ac19d1154822464a639bf882ef78c593088e78a5ef0ce752747a37652fc3b5c9134fd819f4082df7b331095fec9264ac3ebda2edca09ecd2bf2
SSDEEP

12288:1DJnJM4OpSpnO8kTtlTfDxu2h044JB4WOFHXgv4+3otO:NJnJM4OqTWLA2aJzOlXu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bc6866916618eb5090feb4d170a29b0

Files

5bc6866916618eb5090feb4d170a29b0
.exe windows:10 windows x64 arch:x64

28877d46492df107820e0b11fd73235f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_lock
__CxxFrameHandler3
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_unlock
__dllonexit
_onexit
realloc
_CxxThrowException
_vsnwprintf
wcsncmp
_snwprintf_s
wcsstr
wcscat_s
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
_purecall
__C_specific_handler
swprintf_s
memset

ntdll

RtlSetBits
RtlInitializeBitMap
RtlCreateSystemVolumeInformationFolder
NtQueryInformationFile
NtSetInformationFile
RtlCopyUnicodeString
RtlDoesNameContainWildCards
NtFsControlFile
NtWaitForSingleObject
NtOpenFile
RtlGetThreadErrorMode
RtlNumberOfClearBits
WinSqmAddToStreamEx
RtlStringFromGUID
WinSqmEndSession
WinSqmStartSession
NtClose
RtlNtStatusToDosError
RtlGUIDFromString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetThreadErrorMode

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
CoRevokeClassObject
CoInitializeEx
CoUninitialize
CoResumeClassObjects
CoRegisterClassObject
CreateStreamOnHGlobal
CoCreateGuid
CoCreateInstance
CoSuspendClassObjects

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockShared
CreateEventW
InitializeCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
WaitForSingleObject
ResetEvent

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadStringW
GetModuleHandleW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess
OpenProcessToken
GetStartupInfoW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpool
CreateThreadpoolWait
SetThreadpoolTimer
SetThreadpoolWait
SubmitThreadpoolWork
SetThreadpoolThreadMinimum
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum
CreateThreadpool
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindFirstVolumeW
FindVolumeClose
FindNextVolumeW
FindFirstFileW
FindNextFileW
GetFileAttributesW
CreateDirectoryW
FindClose
GetVolumePathNameW
GetFinalPathNameByHandleW
CreateFileW
DeleteFileW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegNotifyChangeKeyValue
RegCreateKeyExW

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

PrivilegeCheck
AdjustTokenPrivileges

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchStripPrefix
PathCchStripToRoot
PathCchSkipRoot

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_Unregister_Notification

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

esent

JetCreateTableColumnIndex2W
JetOpenTableW
JetDeleteTableW
JetSetCurrentIndexW
JetCreateDatabase2W
JetOpenDatabaseW
JetAttachDatabase2W
JetBeginSessionW
JetGetColumnInfoW
JetCloseDatabase
JetCloseTable
JetInit3W
JetTerm2
JetSetSystemParameterW
JetCreateInstance2W
JetEnableMultiInstanceW
JetResetSessionContext
JetSetSessionContext
JetComputeStats
JetGetObjectInfoW
JetEndSession
JetRollback
JetRetrieveColumns
JetSetColumns
JetPrepareUpdate
JetUpdate
JetMove
JetMakeKey
JetSeek
JetBeginTransaction
JetRetrieveColumn
JetDelete
JetCommitTransaction
JetOpenTempTable

clusapi

GetClusterInformation
CloseCluster
OpenCluster

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 396KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28877d46492df107820e0b11fd73235f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-devices-config-l1-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

esent

clusapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 253KB - Virtual size: 253KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 396KB - Virtual size: 736KB

.text
Size: 253KB - Virtual size: 253KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 396KB - Virtual size: 736KB