445123_1[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

445123_1.rar
Size

552KB
MD5

3d7706009ab4fbe237a63baf249f20b3
SHA1

f6019a3a7943ef338285ccb07be5133f0c41e2ba
SHA256

577ddcaf8a4436d6421fa23e9a55f4a7e46ce41bc4efd57a1592c6ac7e23a6e6
SHA512

fa7722dd2479b05c000fe7942ede6f633f9abb5a773aba3410adc0b36083cb43b8c95fe4b476317af3a529e8196c616963037fe47f7996174eddba1664af7640
SSDEEP

12288:z/Xp3wA9QQknsnh6eCNjSJ03/ElJcL065D18P2nVeEo:z/5r9QF8MeCN2m8+7D18PTv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/445123/8kQ3DtBrjVq7.exe

Files

445123_1.rar
.rar
445123/8kQ3DtBrjVq7.exe
.exe windows:6 windows x64 arch:x64

a98fcc30097a9893402b8be27c43a74b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dx9_43

D3DXMatrixTranspose

dwmapi

DwmExtendFrameIntoClientArea

user32

FindWindowA
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
DispatchMessageA
LoadCursorA
SetWindowPos
ShowWindow
GetAsyncKeyState
SetWindowLongA
GetForegroundWindow
MoveWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
LoadIconA
PeekMessageA
UnregisterClassA
PostQuitMessage
RegisterClassExA
UpdateWindow
GetWindowThreadProcessId
GetWindowRect

kernel32

HeapReAlloc
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapAlloc
HeapFree
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
ReadFile
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
LoadLibraryExW
TlsFree
TlsSetValue
WriteProcessMemory
ReadProcessMemory
GetModuleFileNameA
SetConsoleTitleA
GetCurrentProcess
GetTickCount64
K32GetModuleBaseNameA
Process32First
Module32Next
Module32First
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
VirtualProtectEx
GetModuleHandleA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
IsValidCodePage
AreFileApisANSI
GetLastError
GetModuleHandleW
MoveFileExW
GetFileInformationByHandleEx
LocalFree
FormatMessageA
GetLocaleInfoEx
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
SetEndOfFile
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
TlsGetValue
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetEnvironmentVariableW
SetStdHandle
HeapSize
WriteConsoleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
TlsAlloc

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContextEx
ImmGetContext

d3dcompiler_43

D3DCompile

Sections

.text
Size: 701KB - Virtual size: 701KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 649KB - Virtual size: 648KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
445123/config/config.json

Sharing

General

Malware Config

Signatures

Files

a98fcc30097a9893402b8be27c43a74b

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dx9_43

dwmapi

user32

kernel32

imm32

d3dcompiler_43

Sections

.text Size: 701KB - Virtual size: 701KB

.rdata Size: 649KB - Virtual size: 648KB

.data Size: 7KB - Virtual size: 16KB

.pdata Size: 28KB - Virtual size: 28KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 701KB - Virtual size: 701KB

.rdata
Size: 649KB - Virtual size: 648KB

.data
Size: 7KB - Virtual size: 16KB

.pdata
Size: 28KB - Virtual size: 28KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 3KB - Virtual size: 3KB