fe4dec66c024eddde694722025d4d695f36f89209ef3139411fa4e05d4e74475

Sharing

Copy URL Twitter E-mail

General

Target

fe4dec66c024eddde694722025d4d695f36f89209ef3139411fa4e05d4e74475
Size

292KB
MD5

ef6cbb71e2cbd4f731b97dc521a99348
SHA1

7c78fdefadba9257a73a6baaf497d5a38ef490fa
SHA256

fe4dec66c024eddde694722025d4d695f36f89209ef3139411fa4e05d4e74475
SHA512

3e192835c34698a1d7dda920753d123973bcfa2446ee44041990fe4a9f3eaf45808a325498cf1a9db2f6956b74d92a2450b124fe890742e179cb29a507f8ba61
SSDEEP

3072:zxfNu3pt86c6LziFxSOyRysxAEPGRvQhRkKqUa9antF5hvvJkuXpN:itFJ+wIsGE+ohSKq99UF5hvv/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe4dec66c024eddde694722025d4d695f36f89209ef3139411fa4e05d4e74475

Files

fe4dec66c024eddde694722025d4d695f36f89209ef3139411fa4e05d4e74475
.exe windows:10 windows x64 arch:x64

e87fe0e719aebf64a395ede5a983e9b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdi32

ExtTextOutW
SetBkMode
SetTextColor
SetBkColor
GetLayout
GetTextExtentPoint32W

user32

DestroyIcon
LoadIconW
GetWindowLongPtrW
EnableWindow
GetWindowLongW
GetSystemMetrics
GetClientRect
SetDlgItemTextW
IsDialogMessageW
CreateDialogParamW
DestroyWindow
DialogBoxParamW
EndDialog
SetFocus
GetSysColor
DrawIconEx
DrawFocusRect
PostMessageW
GetMessageW
GetWindowTextW
SetForegroundWindow
TranslateMessage
DispatchMessageW
EnumWindows
LoadStringW
GetParent
MessageBoxW
ShowWindow
SendMessageW
SetWindowLongPtrW
SendDlgItemMessageW
GetDlgItem

msvcrt

realloc
_vsnwprintf
memset
sqrt
malloc
free
memcpy_s
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_i64toa_s
_wcsicmp
toupper
wcscmp

comctl32

ImageList_Create
PropertySheetW
CreatePropertySheetPageW
ord345
ord17
ImageList_ReplaceIcon

shell32

ShellExecuteExW
ord680
ExtractIconExW
SHGetFileInfoW

shlwapi

StrCmpNW
StrCmpW
StrToIntW
StrStrIW
ord271
ord487
SHDeleteKeyW
PathStripToRootW
StrFormatByteSizeW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
TerminateProcess

api-ms-win-core-heap-l1-1-0

HeapSetInformation
GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleFileNameA

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetErrorMode
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateEventW
ReleaseMutex
AcquireSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
SetEvent

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventActivityIdControl
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoUninitialize

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetTickCount

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

GetVolumeInformationW
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW

oleaut32

VariantInit
SysStringLen
VariantClear

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

lstrlenW
CheckElevationEnabled
GetStartupInfoA
MulDiv

ntdll

RtlNtStatusToDosError
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
NtFsControlFile
NtCreateFile
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString

ole32

CoInitialize

vssapi

VssFreeSnapshotPropertiesInternal
CreateVssBackupComponentsInternal

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e87fe0e719aebf64a395ede5a983e9b7

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

comctl32

shell32

shlwapi

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

oleaut32

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

kernel32

ntdll

ole32

vssapi

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

Sections

.text Size: 84KB - Virtual size: 84KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 175KB - Virtual size: 175KB

.reloc Size: 512B - Virtual size: 128B

.text
Size: 84KB - Virtual size: 84KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 175KB - Virtual size: 175KB

.reloc
Size: 512B - Virtual size: 128B