c80a1c2c9fc2afbbd158efa3474a8bcabec78ed1a3330e696752c6e499c646a5

Sharing

Copy URL Twitter E-mail

General

Target

c80a1c2c9fc2afbbd158efa3474a8bcabec78ed1a3330e696752c6e499c646a5
Size

871KB
MD5

61cb56e4eeb1049f05bc2f3e40e0ab4c
SHA1

12045b2fc4ce8087b4e60ab2aeebb9021148520c
SHA256

c80a1c2c9fc2afbbd158efa3474a8bcabec78ed1a3330e696752c6e499c646a5
SHA512

a38a63f27d2fa6bcb9a539ca3bc61db687563d4cd13b7611584f903c0cd5232486811e67b4501a28a577c7a9a611ad78e7eb44f7f0d114982f38871c8db13349
SSDEEP

12288:LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LsqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c80a1c2c9fc2afbbd158efa3474a8bcabec78ed1a3330e696752c6e499c646a5

Files

c80a1c2c9fc2afbbd158efa3474a8bcabec78ed1a3330e696752c6e499c646a5
.exe windows:6 windows x64 arch:x64

0066d4fa26b0435551700f0a9e82e6ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\DRW\DRW17.0-All\DRWIntelligentScan\DRWLoader\x64\Release\DRWLoader.pdb

Imports

publog

?DebugTrace@@YAXPEBDZZ

kernel32

CreateMutexA
WriteFile
GetModuleFileNameA
GetPrivateProfileStringA
LoadLibraryA
GetLocalTime
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CreateFileA
FreeLibrary
MapViewOfFile
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateEventA
GetModuleFileNameW
CreateProcessW
GetExitCodeProcess
CreateProcessA
SetEnvironmentVariableA
WaitForMultipleObjects
GetCurrentThread
GetCurrentProcess
GetVersion
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
GetCurrentThreadId
CreateFileMappingA
OutputDebugStringA
ReleaseMutex
WaitForSingleObject
CloseHandle
UnmapViewOfFile
LeaveCriticalSection
HeapDestroy
EnterCriticalSection
GetSystemTimeAsFileTime
InitializeSListHead
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
QueryPerformanceCounter

user32

MessageBoxA
LoadStringA

advapi32

EqualSid
GetTokenInformation
FreeSid
OpenProcessToken
OpenThreadToken
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
wcsrchr
_purecall
__std_terminate
__CxxFrameHandler3
memmove
__C_specific_handler
memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_set_fmode
__stdio_common_vsprintf_s
__p__commode

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
terminate
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_invalid_parameter_noinfo
_exit
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
_callnewh
free
calloc

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-string-l1-1-0

strcat_s
_stricmp
strcmp

api-ms-win-crt-multibyte-l1-1-0

_mbscmp
_mbsrchr

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 832KB - Virtual size: 836KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0066d4fa26b0435551700f0a9e82e6ad

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

publog

kernel32

user32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 832KB - Virtual size: 836KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 832KB - Virtual size: 836KB