6c1faa5c62048ee4f4a189800932c9c6[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

6c1faa5c62048ee4f4a189800932c9c6.exe
Size

3.2MB
MD5

6c1faa5c62048ee4f4a189800932c9c6
SHA1

773182afd9a8a721e8e1eb07affbddbdbb4a26a6
SHA256

7be09d9db347e78624a5fb16659f54ede30d7294baeb57bbe7459f90a2d8ecd4
SHA512

3a3706c6d7c0b36d89e863fd8ecdee586ac81848688434fa6bdabab08a9605e6d56a5dcc5fbe9d41d4dbb44aa19f096ed64c96eaa52fcdcf65c91902918a3a19
SSDEEP

98304:7PVcsxxMFqbzI03I5fNewbLGQ1iZLy/n:7faF+zI03IWw2zen

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c1faa5c62048ee4f4a189800932c9c6.exe

Files

6c1faa5c62048ee4f4a189800932c9c6.exe
.exe windows:4 windows x64 arch:x64

e7d5dacc0da7481a9d9e940b4b83da49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\data\buildbot-pdk-slave\pdk-aswinx64\build\src\PerlApp\src\paperl514.pdb

Imports

comctl32

ord17

kernel32

FreeLibrary
SystemTimeToFileTime
SetFileTime
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
FindFirstFileA
GetLastError
GetProcAddress
EnterCriticalSection
FindClose
LoadLibraryA
SetEnvironmentVariableA
GetModuleFileNameA
FindNextFileA
GetModuleHandleA
LoadLibraryExA
DeleteCriticalSection
CreateFileA
OutputDebugStringA
GetVersionExA
CloseHandle
GetFileInformationByHandle
GetTempPathA
FindResourceA
LoadResource
LockResource
SetLastError
VirtualProtect
VirtualFree
RtlDeleteFunctionTable
RtlAddFunctionTable
VirtualAlloc
MultiByteToWideChar
ExitThread
RtlLookupFunctionEntry
RtlVirtualUnwind
GetComputerNameA
GetShortPathNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext

user32

MessageBoxA

advapi32

GetUserNameA

msvcrt

strchr
fflush
atoi
_errno
strncpy
fgets
_environ
fread
rand
localtime
srand
isdigit
fwrite
toupper
time
atol
getenv
fclose
memmove
strrchr
memset
strcmp
memcpy
strcpy
strlen
wcscmp
memcmp
_rmdir
_chmod
_fileno
_putenv
_strdup
strstr
_getpid
_strnicmp
_unlink
_dup2
_mkdir
_stricmp
__dllonexit
_onexit
__C_specific_handler
_XcptFilter
_c_exit
_exit
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
vsprintf
perror
sprintf
fputc
abort
_iob
fprintf
malloc
free
_stat
fputs
fopen
calloc
_setjmp

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7d5dacc0da7481a9d9e940b4b83da49

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

advapi32

msvcrt

Sections

.text Size: 65KB - Virtual size: 65KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 5KB - Virtual size: 7KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 3.1MB - Virtual size: 3.1MB

.text
Size: 65KB - Virtual size: 65KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 5KB - Virtual size: 7KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3.1MB - Virtual size: 3.1MB