64c8243738d6fcbe03e442e564fec2284b58236a1efdfbdbafa01b54b1aeb9ed

Sharing

Copy URL Twitter E-mail

General

Target

64c8243738d6fcbe03e442e564fec2284b58236a1efdfbdbafa01b54b1aeb9ed
Size

75KB
MD5

0208700978144308b52e77e744e998d6
SHA1

8a2ea64efcde3afb24cd13b1ae9465d0014b3c6f
SHA256

64c8243738d6fcbe03e442e564fec2284b58236a1efdfbdbafa01b54b1aeb9ed
SHA512

1f718bab34d66783c3b62a28207c165753eb6bb2d6f84f893f7b475b43e895e4e9ba16912f53acc175d597b877a2fdb3ad65e273c5e63e178224446c1d46fddb
SSDEEP

768:1IlzNS/HbLNcOHyYfxTIBM+DfAhieC89r8BTAf/+dayKjRF0bWyocHlGQ1H:17OU5UBM+DIw389r8dAmZKjRF0uqGQd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64c8243738d6fcbe03e442e564fec2284b58236a1efdfbdbafa01b54b1aeb9ed

Files

64c8243738d6fcbe03e442e564fec2284b58236a1efdfbdbafa01b54b1aeb9ed
.exe windows:6 windows x64 arch:x64

29f4c99735af7415c168fe33048cad6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

base

?string2wstring@StringEx@Base@Public@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@@Z
?toInt@Value@Base@Public@@QEBAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??4Value@Base@Public@@QEAAAEAV012@AEBV012@@Z
??1Value@Base@Public@@QEAA@XZ
??0Value@Base@Public@@QEAA@XZ
??0Value@Base@Public@@QEAA@PEBD@Z
??0Value@Base@Public@@QEAA@AEBV012@@Z
?printer@Base@Public@@YAXW4LOG_Level@12@PEBD1H1AEBV?$vector@VValue@Base@Public@@V?$allocator@VValue@Base@Public@@@std@@@std@@@Z
?sleep@Thread@Base@Public@@SAXH@Z
??7ErrorInfo@Base@Public@@QEBA_NXZ
?indexOfByCase@StringEx@Base@Public@@SA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??BErrorInfo@Base@Public@@QEBA_NXZ
??4ErrorInfo@Base@Public@@QEAAAEAV012@AEBV012@@Z
??1ErrorInfo@Base@Public@@QEAA@XZ
??0ErrorInfo@Base@Public@@QEAA@W4ErrorCode@12@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?getProcessIdsByName@Process@Base@Public@@SA?AV?$set@IU?$less@I@std@@V?$allocator@I@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@@Z
?existByPid@Process@Base@Public@@SA_NH@Z
?startSaveLog@BaseSystem@Base@Public@@SAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4LOG_Level@23@0@Z
?killByPid@Process@Base@Public@@SA_NH@Z
?access@File@Base@Public@@SA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4AccessMode@123@@Z
?makeDirectory@File@Base@Public@@SA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?getExcutableFileName@File@Base@Public@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getOemInfo@OEMInfo@@SA?AUOEMDefine@@XZ

vmsupdater

?setError@VMSInstaller@VMSUpdate@Milesight@@UEAAXW4ErrorCode@IExtractOutFile@@@Z
?start@VMSInstaller@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
??0VMSInstaller@VMSUpdate@Milesight@@QEAA@AEBV?$shared_ptr@VIBackup@VMSUpdate@Milesight@@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@W4VersionType@12@@Z
??1VMSInstaller@VMSUpdate@Milesight@@UEAA@XZ
?write@Log@VMSUpdate@Milesight@@SA?AVErrorInfo@Base@Public@@PEADZZ
?clear@Backup@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@XZ
?restore@Backup@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?open@VMSInstaller@VMSUpdate@Milesight@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?restore@Backup@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$Function@$$A6AXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVErrorInfo@Base@Public@@@Z$$V@56@@Z
?write@VMSInstaller@VMSUpdate@Milesight@@UEAA_NPEBDI@Z
?backup@Backup@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?backup@Backup@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$Function@$$A6AXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVErrorInfo@Base@Public@@@Z$$V@56@@Z
??1Backup@VMSUpdate@Milesight@@UEAA@XZ
??0Backup@VMSUpdate@Milesight@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?stop@VMSInstaller@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@XZ
?threadProc@VMSInstaller@VMSUpdate@Milesight@@EEAAXXZ
?getPackageVersion@VMSInstaller@VMSUpdate@Milesight@@QEAAHXZ
?getError@VMSInstaller@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@XZ
?finish@VMSInstaller@VMSUpdate@Milesight@@UEAA_NXZ
?getProgress@VMSInstaller@VMSUpdate@Milesight@@UEAA?AVErrorInfo@Base@Public@@AEAM@Z
?close@VMSInstaller@VMSUpdate@Milesight@@UEAA_NXZ

kernel32

DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ResetEvent
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
GetCurrentProcess
WaitForSingleObject
GetSystemDirectoryA
DeleteFileA
CloseHandle
WTSGetActiveConsoleSessionId
CreateProcessW
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
SetEvent
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
InitializeSListHead

advapi32

SetTokenInformation
LookupPrivilegeValueA
SetServiceStatus
AdjustTokenPrivileges
CreateServiceW
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
OpenSCManagerA
DeleteService
ControlService
StartServiceA
OpenProcessToken
CreateProcessAsUserW
OpenServiceW
DuplicateTokenEx
ChangeServiceConfig2A
OpenServiceA
CloseServiceHandle
QueryServiceStatus

msvcp140

_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ

vcruntime140

__RTDynamicCast
memcmp
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
__std_type_info_name
__C_specific_handler
_CxxThrowException
memset
memcpy
memmove

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_c_exit
__p___argv
_invalid_parameter_noinfo_noreturn
terminate
_set_error_mode
_configure_narrow_argv
__p___argc
_initialize_narrow_environment
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29f4c99735af7415c168fe33048cad6d

Headers

DLL Characteristics

File Characteristics

Imports

wtsapi32

userenv

base

vmsupdater

kernel32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 42KB - Virtual size: 41KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 364B

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 364B