sadhuieas[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

sadhuieas.exe
Size

807KB
MD5

d4f13987130eaaca200545fd6ab195b6
SHA1

eb641a4540c58da39c57aa4f50d228b52c574946
SHA256

ce29140d1bce94c3b12cc8c3a73eac3635a16b3b09fc92e02f8f034d7bc2da7f
SHA512

2a730c144012f2b631a5a7cdddf550fde0c4b74c21bb3be49091ec2258ed3c3c524e12106c8a8f1cb5c1106d5f9f946dd3df75fe6c7d8a034be436c7dc423d07
SSDEEP

12288:u7ppQEinAL72cq3wXrdZubJWfNClUPYOF0DI8+LB1hgsEWowRnkZL:KY9AWL3aqwOp08+LB1hgFWxRnU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sadhuieas.exe

Files

sadhuieas.exe
.exe windows:6 windows x64 arch:x64

aebe1659bf1306f04d70dd184e4b5394

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Folders\Rainy Products\peak script\imgui\x64\Release\ImGui Base.pdb

Imports

kernel32

VerSetConditionMask
VerifyVersionInfoW
QueryPerformanceCounter
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
OutputDebugStringW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapAlloc
HeapFree
GetConsoleMode
GetProcAddress
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
WriteFile
FreeLibraryAndExitThread
ExitThread
CreateThread
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
ReadFile
RtlUnwind
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RaiseException
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GlobalFree
GlobalAlloc
GetConsoleOutputCP
MultiByteToWideChar
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
CloseHandle
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
GetCurrentThreadId
WaitForSingleObjectEx
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
SetEndOfFile

user32

GetSystemMetrics
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
ReleaseDC
SetCursorPos
IsIconic
GetCursorInfo
SendInput
DispatchMessageA
GetWindowRect
GetAsyncKeyState
TranslateMessage
PeekMessageA
PostQuitMessage
GetDesktopWindow
UpdateWindow
GetWindowLongW
AdjustWindowRectEx
GetKeyState
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
ShowWindow
GetCapture
SetWindowLongA
ClientToScreen
IsChild
GetMonitorInfoA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetCapture
SetCursor
SetWindowLongW
GetClientRect
UnregisterClassA
RegisterClassExA
ReleaseCapture
SetForegroundWindow

gdi32

GetDeviceCaps

advapi32

RegQueryValueExA
RegOpenKeyA
RegCloseKey

xinput1_4

ord4
ord2

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

d3d9

Direct3DCreate9

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

urlmon

URLDownloadToFileA

Sections

.text
Size: 591KB - Virtual size: 591KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aebe1659bf1306f04d70dd184e4b5394

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

xinput1_4

imm32

d3d9

ntdll

urlmon

Sections

.text Size: 591KB - Virtual size: 591KB

.rdata Size: 178KB - Virtual size: 177KB

.data Size: 6KB - Virtual size: 13KB

.pdata Size: 26KB - Virtual size: 25KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 591KB - Virtual size: 591KB

.rdata
Size: 178KB - Virtual size: 177KB

.data
Size: 6KB - Virtual size: 13KB

.pdata
Size: 26KB - Virtual size: 25KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 3KB - Virtual size: 3KB