249c54c4619230c13f61eed111a989f846540d7497c3cc9857fb5fc6d9415181

Sharing

Copy URL Twitter E-mail

General

Target

249c54c4619230c13f61eed111a989f846540d7497c3cc9857fb5fc6d9415181
Size

874KB
MD5

008ac961124311ba543946aabdb40e03
SHA1

e382d81e4f8f9351f84b42252f943b83628fc4fb
SHA256

249c54c4619230c13f61eed111a989f846540d7497c3cc9857fb5fc6d9415181
SHA512

b4aa82384c728048e5d69f4c89678278fb6030112884f058aacba10e462e89595b82516ec34b2fe1cbe20d1e30485bc7959c289f2f23edb1401cd45db478392f
SSDEEP

24576:9KrJRSJDtKw+GCC5/NWiJwYJxKvxTg34eUIK56TtucI62398M:WJRSNt9+G3pJHUxs34eUIK56TtucI13

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
249c54c4619230c13f61eed111a989f846540d7497c3cc9857fb5fc6d9415181

Files

249c54c4619230c13f61eed111a989f846540d7497c3cc9857fb5fc6d9415181
.exe windows:6 windows x64 arch:x64

6e385980ea1e2227e8142aa4bb631858

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

G:\work\LAStools\x64\Release\lasintensity64.pdb

Imports

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
GetModuleHandleA
FindFirstFileA
FindNextFileA
FindClose
GetFileAttributesExA
FileTimeToSystemTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
MultiByteToWideChar
RtlCaptureContext

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?uncaught_exception@std@@YA_NXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove
memcpy
memcmp
__std_exception_destroy
memset
_CxxThrowException
__current_exception
__C_specific_handler
strstr
_purecall
__std_terminate
__std_exception_copy
__current_exception_context

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_set_app_type
_seh_filter_exe
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_invalid_parameter_noinfo_noreturn
_exit
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
_dup2
_dup
_pipe
_close
fseek
fgetc
_wfopen
ftell
_ftelli64
setvbuf
_fileno
_setmode
__acrt_iob_func
fclose
fopen
fwrite
fputc
fread
__stdio_common_vsscanf
_fseeki64
__stdio_common_vsprintf
getc
fgets
__stdio_common_vfprintf

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
remove

api-ms-win-crt-string-l1-1-0

_strdup
tolower
strtok
strncmp
strncpy
strcmp

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
realloc
calloc
free

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

api-ms-win-crt-convert-l1-1-0

atoi
atof

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-process-l1-1-0

_spawnlp

api-ms-win-crt-math-l1-1-0

__setusermatherr
cos
powf
sin
sqrt
cosf
ceilf
expf
pow

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 553KB - Virtual size: 553KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e385980ea1e2227e8142aa4bb631858

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-process-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 553KB - Virtual size: 553KB

.rdata Size: 266KB - Virtual size: 265KB

.data Size: 22KB - Virtual size: 23KB

.pdata Size: 22KB - Virtual size: 21KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 553KB - Virtual size: 553KB

.rdata
Size: 266KB - Virtual size: 265KB

.data
Size: 22KB - Virtual size: 23KB

.pdata
Size: 22KB - Virtual size: 21KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 9KB - Virtual size: 8KB