hdfkwrg1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

hdfkwrg1.exe
Size

124KB
MD5

e898826598a138f86f2aa80c0830707a
SHA1

1e912a5671f7786cc077f83146a0484e5a78729c
SHA256

df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA512

6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
SSDEEP

3072:BjPJ7NhSP0ZfeOF0w3c0rI0QIWfh9I+ySgxcFgT75CJvs7QTkeNa8B4eeRHLbiX7:tWpw9rIkWfbDjgxEgT7Ii7Oke88aVrbY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hdfkwrg1.exe

Files

hdfkwrg1.exe
.exe windows:6 windows x64 arch:x64

458ff1de180ad138e1ac7a85ae8a528b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Desktop\Manual Map Injector\x64\Release\Injector-x64.pdb

Imports

kernel32

LoadLibraryA
CloseHandle
VirtualProtectEx
GetProcAddress
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
GetLastError
GetCommandLineW
GetCurrentProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
IsWow64Process
GetCurrentProcessId
Sleep
RtlAddFunctionTable
GetExitCodeProcess
WriteProcessMemory
GetCurrentThreadId
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW

shell32

CommandLineToArgvW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

_CxxThrowException
__std_exception_destroy
memcpy
memmove
__current_exception_context
__C_specific_handler
__current_exception
__std_exception_copy
memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__p__commode

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free
_callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_c_exit
terminate
_initterm_e
_cexit
exit
_exit
_register_thread_local_exe_atexit_callback
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
system

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

458ff1de180ad138e1ac7a85ae8a528b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 113KB - Virtual size: 112KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 360B

.pdata Size: 1024B - Virtual size: 600B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 84B

.text
Size: 113KB - Virtual size: 112KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 360B

.pdata
Size: 1024B - Virtual size: 600B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 84B