be6c3cfe2883bce9885646bed2877cb1

Sharing

Copy URL Twitter E-mail

General

Target

be6c3cfe2883bce9885646bed2877cb1
Size

55KB
MD5

be6c3cfe2883bce9885646bed2877cb1
SHA1

42f79263198e32036eeefb1b70f2aaf44a4c2d7f
SHA256

9f406cec8484f404dc10861717110199b3798afd2ca12850657a4578ede2b39a
SHA512

8c09acf287e0fe3b8f5e0ca56b3fc10173df5a3ca6ee1a40fd5c5e3e6f831c2ff5b3593726138196078b7d1af677c404c00fc4fa16c9e4a57cb7ce02aeb7fb8b
SSDEEP

1536:A5fnGXYxKTUtmPe3cGsI+1bFZTpKnekq02WkpAufWIr:A2BIsbFR6Hq02WkD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be6c3cfe2883bce9885646bed2877cb1

Files

be6c3cfe2883bce9885646bed2877cb1
.exe windows:6 windows x86 arch:x86

9dcbf6851631fcc0d50034d7282c766b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wermgr.pdb

Imports

msvcrt

_acmdln
_cexit
_exit
_XcptFilter
_ismbblead
wcsncmp
_vsnprintf
_vscwprintf
_wcsnicmp
_wcsicmp
exit
__getmainargs
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_wtoi64
_wtoi
memset
_vsnwprintf
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type

advapi32

RevertToSelf
IsValidSid
GetLengthSid
CopySid
RegGetValueW
OpenProcessToken
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
CreateProcessAsUserW
ImpersonateLoggedOnUser
ConvertSidToStringSidW
RegQueryValueExW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW

kernel32

ReadProcessMemory
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
UnmapViewOfFile
CloseHandle
CreateProcessW
SetEvent
GetLastError
MapViewOfFile
Wow64RevertWow64FsRedirection
GetSystemDirectoryW
Wow64DisableWow64FsRedirection
IsWow64Process
GlobalFree
GetCommandLineW
HeapSetInformation
DeleteFileW
OpenProcess
GetSystemDefaultLCID
InterlockedIncrement
lstrlenW
InterlockedDecrement
CreateEventW
LocalFree
OutputDebugStringA
GetProcAddress
OpenMutexW
HeapFree
OpenPrivateNamespaceW
HeapAlloc
GetProcessHeap
WaitForSingleObject
GetModuleHandleW
OpenFileMappingW
ClosePrivateNamespace
CreateFileMappingW
GetApplicationRecoveryCallback

ole32

StringFromGUID2
CoInitialize
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize

oleaut32

SysAllocString
LoadRegTypeLi
SysFreeString
SysAllocStringLen
LoadTypeLibEx

shell32

CommandLineToArgvW
ShellExecuteExW

wer

WerpAddRegisteredDataToReport
WerpSetCallBack
WerReportSubmit
WerReportCloseHandle
WerReportAddDump
WerpEnumerateStoreStart
WerpEnumerateStoreNext
WerpOpenMachineQueue
WerpSubmitReportFromStore
WerpOpenUserQueue
WerpCloseStore
WerpShowNXNotification
WerpIsTransportAvailable
WerpSetReportInformation
WerpGetReportInformation
WerpGetReportType
WerpLoadReport

user32

CloseWindowStation
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
CloseDesktop

ntdll

RtlAllocateAndInitializeSid
RtlCreateBoundaryDescriptor
RtlCreateServiceSid
RtlAddSIDToBoundaryDescriptor
RtlDeleteBoundaryDescriptor
NtQueryInformationProcess
RtlInitUnicodeString
NtQueryInformationToken
NtClose
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9dcbf6851631fcc0d50034d7282c766b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

ole32

oleaut32

shell32

wer

user32

ntdll

Sections

.text Size: 45KB - Virtual size: 45KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 34KB

.text
Size: 45KB - Virtual size: 45KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 34KB