59c102465a05a8b705606cae5918d14e9b8dbe7016bdeecbbe2ec19fdc35f6d4

Sharing

Copy URL Twitter E-mail

General

Target

59c102465a05a8b705606cae5918d14e9b8dbe7016bdeecbbe2ec19fdc35f6d4
Size

95KB
MD5

2f8a0ab0c5296f00f54e011caf8101f3
SHA1

682f9ce7c2b26f324b3641e849520b45daa74c19
SHA256

59c102465a05a8b705606cae5918d14e9b8dbe7016bdeecbbe2ec19fdc35f6d4
SHA512

1c58d8fb4571e187ed82dedac83ad6edecd81110e81999806b3ab6b2fad1998bf77e9035263be946ba7c19e5a81dd5c2d6a0c72261b03e3091fe94d57d428f4f
SSDEEP

1536:s7j7943tcI65nkVnTTV/IOsfRjCrCBvYO3qzSlaB4D:KIe5nkVnV/ILZVgO3qzSlaB4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59c102465a05a8b705606cae5918d14e9b8dbe7016bdeecbbe2ec19fdc35f6d4

Files

59c102465a05a8b705606cae5918d14e9b8dbe7016bdeecbbe2ec19fdc35f6d4
.exe windows:5 windows x86 arch:x86

0e7c5bd4b80eb108f814b0e207587c43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\workspace\AgentClientEXE\Release\AgentClientEXE.pdb

Imports

kernel32

FileTimeToLocalFileTime
FileTimeToSystemTime
CloseHandle
GetLocalTime
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileTime
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
LocalFree
WideCharToMultiByte
CreateFileA
DeleteFileA
InterlockedIncrement
GetPrivateProfileIntA
lstrlenA
MultiByteToWideChar
GetLastError
GetCurrentProcess
InterlockedDecrement

user32

RegisterClassExA
LoadStringA
LoadAcceleratorsA
EndDialog
PostQuitMessage
SetTimer
BeginPaint
DefWindowProcA
DestroyWindow
DialogBoxParamA
UpdateWindow
CreateWindowExA
EndPaint
LoadCursorA
LoadIconA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

ole32

CoUninitialize
OleRun
CoCreateInstance
CoInitialize

oleaut32

SysStringLen
VariantChangeType
SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringByteLen
VariantClear
VariantInit
GetErrorInfo

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

msvcr100

_except_handler4_common
_crt_debugger_hook
_fmode
_commode
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
__set_app_type
_controlfp_s
??3@YAXPAX@Z
memcpy_s
??2@YAPAXI@Z
??_V@YAXPAX@Z
_access
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
memmove
sprintf_s
memchr
free
malloc
__CxxFrameHandler3
_CxxThrowException
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
memcpy

agentclient

ord2

log

ord1

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e7c5bd4b80eb108f814b0e207587c43

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

msvcp100

msvcr100

agentclient

log

Sections

.text Size: 30KB - Virtual size: 30KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 30KB - Virtual size: 30KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 3KB - Virtual size: 3KB