00d35ffa5655516363c27d2cc090c7ef1faba6cf3570bee9c3527c6dfa48660f

Sharing

Copy URL Twitter E-mail

General

Target

00d35ffa5655516363c27d2cc090c7ef1faba6cf3570bee9c3527c6dfa48660f
Size

651KB
MD5

9222116b72e9928297a637300d7aba61
SHA1

7e1ee19403760d14f029fac98a6537512d76338f
SHA256

00d35ffa5655516363c27d2cc090c7ef1faba6cf3570bee9c3527c6dfa48660f
SHA512

d90c8fee5077a21a00f48d1cbcea65a069984af48bdeb535dc6c73684d2c62f69e2ba9d8c46b85a8d828f3afb7b9111026d6749f35e86517f88f0af96559e060
SSDEEP

12288:bI0gwALPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zao:bNgZLbpT0rdwQWOwN7PPpgyqn4zP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00d35ffa5655516363c27d2cc090c7ef1faba6cf3570bee9c3527c6dfa48660f

Files

00d35ffa5655516363c27d2cc090c7ef1faba6cf3570bee9c3527c6dfa48660f
.exe windows:6 windows x64 arch:x64

28cdbc1f0ca1a70c86db63083c113a44

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

magic_xe_module_wrap_rapidjson

?ParsePostParamConfig@ConfigParser@module@magic_xe@@SA?AW4MagicXEError@@AEAVModel@3@PEAUParamPost@3@@Z
?ParseInferenceConfig@ConfigParser@module@magic_xe@@SA?AW4MagicXEError@@AEAVModel@3@PEAUModelConfig@3@PEAUNetworkConfig@3@PEAUParamConverter@3@PEAUModelReserveConfig@3@@Z

magic_xe_kernel

MagicXELoggerInit
?MultiByteCharToWString@StringUtils@magic_xe@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z
?Parse@Model@magic_xe@@QEAA?AW4MagicXEError@@XZ
??1Model@magic_xe@@QEAA@XZ
??0Model@magic_xe@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?CreateInstance@Inference@magic_xe@@QEAA?AV?$shared_ptr@VInstance@magic_xe@@@std@@AEAVStatus@2@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@HV?$allocator@H@std@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@HV?$allocator@H@std@@@2@@std@@@2@@4@@Z
?SetNetworkConfig@Inference@magic_xe@@QEAA?AVStatus@2@AEAUNetworkConfig@2@@Z
?Init@Inference@magic_xe@@QEAA?AVStatus@2@AEAUModelConfig@2@AEAUNetworkConfig@2@@Z
??1Inference@magic_xe@@QEAA@XZ
??0Inference@magic_xe@@QEAA@XZ
?SetInputBlob@Instance@magic_xe@@QEAA?AVStatus@2@V?$shared_ptr@VBlob@magic_xe@@@std@@PEAUParamConverter@2@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@@Z
?GetAllInputBlobs@Instance@magic_xe@@QEAA?AVStatus@2@AEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VBlob@magic_xe@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VBlob@magic_xe@@@2@@std@@@2@@std@@@Z
?Forward@Instance@magic_xe@@QEAA?AVStatus@2@XZ
?GetDefaultCpuDeviceType@DeviceUtils@magic_xe@@SA?AW4MagicXEDeviceType@@XZ
?GetBlobDesc@Blob@magic_xe@@QEAA?AUBlobDesc@2@XZ
??0Blob@magic_xe@@QEAA@AEAUBlobDesc@1@_N@Z
?GetFileParentPath@FileUtils@magic_xe@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@_N@Z
??9Status@magic_xe@@QEAA_NW4MagicXEError@@@Z
??1Status@magic_xe@@QEAA@XZ
??0Status@magic_xe@@QEAA@W4MagicXEError@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
MagicXELoggerLog

msvcp140

_Query_perf_counter
_Query_perf_frequency
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1_Lockit@std@@QEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

vcruntime140

__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcmp
__std_exception_copy
memmove
memset
__C_specific_handler
memcpy
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
exit
terminate
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers
setvbuf
ungetc
_fseeki64
fsetpos
fread
fwrite
__p__commode
fputc
fgetpos
fgetc
fflush
fclose
_set_fmode

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-heap-l1-1-0

realloc
malloc
_callnewh
free
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

CloseHandle
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

Exports

Exports

??0AbstractParam@magic_xe@@QEAA@AEBV01@@Z
??0AbstractParam@magic_xe@@QEAA@XZ
??0BlobDesc@magic_xe@@QEAA@$$QEAU01@@Z
??0BlobDesc@magic_xe@@QEAA@AEBU01@@Z
??0BlobDesc@magic_xe@@QEAA@XZ
??0BlobHandle@magic_xe@@QEAA@XZ
??0Inference@magic_xe@@QEAA@AEBV01@@Z
??0Instance@magic_xe@@QEAA@AEBV01@@Z
??0MemorySizeInfo@magic_xe@@QEAA@$$QEAU01@@Z
??0MemorySizeInfo@magic_xe@@QEAA@AEBU01@@Z
??0MemorySizeInfo@magic_xe@@QEAA@XZ
??0Model@magic_xe@@QEAA@AEBV01@@Z
??0ModelConfig@magic_xe@@QEAA@$$QEAU01@@Z
??0ModelConfig@magic_xe@@QEAA@AEBU01@@Z
??0ModelConfig@magic_xe@@QEAA@XZ
??0ModelIO@magic_xe@@QEAA@AEBV01@@Z
??0ModelIO@magic_xe@@QEAA@XZ
??0ModelReserveConfig@magic_xe@@QEAA@$$QEAU01@@Z
??0ModelReserveConfig@magic_xe@@QEAA@AEBU01@@Z
??0ModelReserveConfig@magic_xe@@QEAA@XZ
??0NetworkConfig@magic_xe@@QEAA@$$QEAU01@@Z
??0NetworkConfig@magic_xe@@QEAA@AEBU01@@Z
??0NetworkConfig@magic_xe@@QEAA@XZ
??0ParamConverter@magic_xe@@QEAA@$$QEAU01@@Z
??0ParamConverter@magic_xe@@QEAA@AEBU01@@Z
??0ParamConverter@magic_xe@@QEAA@XZ
??0ParamPost@magic_xe@@QEAA@XZ
??0Status@magic_xe@@QEAA@AEBV01@@Z
??1AbstractParam@magic_xe@@UEAA@XZ
??1BlobDesc@magic_xe@@QEAA@XZ
??1MemorySizeInfo@magic_xe@@QEAA@XZ
??1ModelConfig@magic_xe@@QEAA@XZ
??1ModelIO@magic_xe@@UEAA@XZ
??1ModelReserveConfig@magic_xe@@QEAA@XZ
??1NetworkConfig@magic_xe@@QEAA@XZ
??1ParamConverter@magic_xe@@QEAA@XZ
??4AbstractParam@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4BlobDesc@magic_xe@@QEAAAEAU01@$$QEAU01@@Z
??4BlobDesc@magic_xe@@QEAAAEAU01@AEBU01@@Z
??4BlobHandle@magic_xe@@QEAAAEAU01@$$QEAU01@@Z
??4BlobHandle@magic_xe@@QEAAAEAU01@AEBU01@@Z
??4ConfigParser@module@magic_xe@@QEAAAEAV012@$$QEAV012@@Z
??4ConfigParser@module@magic_xe@@QEAAAEAV012@AEBV012@@Z
??4DeviceUtils@magic_xe@@QEAAAEAV01@$$QEAV01@@Z
??4DeviceUtils@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4DimsVectorUtils@magic_xe@@QEAAAEAV01@$$QEAV01@@Z
??4DimsVectorUtils@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4FileUtils@magic_xe@@QEAAAEAV01@$$QEAV01@@Z
??4FileUtils@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4Inference@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4Instance@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4MemorySizeInfo@magic_xe@@QEAAAEAU01@$$QEAU01@@Z
??4MemorySizeInfo@magic_xe@@QEAAAEAU01@AEBU01@@Z
??4Model@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4ModelConfig@magic_xe@@QEAAAEAU01@$$QEAU01@@Z
??4ModelConfig@magic_xe@@QEAAAEAU01@AEBU01@@Z
??4ModelIO@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4ModelReserveConfig@magic_xe@@QEAAAEAU01@$$QEAU01@@Z
??4ModelReserveConfig@magic_xe@@QEAAAEAU01@AEBU01@@Z
??4NetworkConfig@magic_xe@@QEAAAEAU01@$$QEAU01@@Z
??4NetworkConfig@magic_xe@@QEAAAEAU01@AEBU01@@Z
??4ParamConverter@magic_xe@@QEAAAEAU01@$$QEAU01@@Z
??4ParamConverter@magic_xe@@QEAAAEAU01@AEBU01@@Z
??4ParamPost@magic_xe@@QEAAAEAU01@$$QEAU01@@Z
??4ParamPost@magic_xe@@QEAAAEAU01@AEBU01@@Z
??4Status@magic_xe@@QEAAAEAV01@AEBV01@@Z
??4StringUtils@magic_xe@@QEAAAEAV01@$$QEAV01@@Z
??4StringUtils@magic_xe@@QEAAAEAV01@AEBV01@@Z
??_7AbstractParam@magic_xe@@6B@
??_7ModelIO@magic_xe@@6B@
??_FStatus@magic_xe@@QEAAXXZ
?GetParam@AbstractParam@magic_xe@@UEAA?AW4MagicXEError@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAH@Z
?GetParam@AbstractParam@magic_xe@@UEAA?AW4MagicXEError@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAM@Z
?GetParam@AbstractParam@magic_xe@@UEAA?AW4MagicXEError@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV45@@Z
?SetParam@AbstractParam@magic_xe@@UEAA?AW4MagicXEError@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?SetParam@AbstractParam@magic_xe@@UEAA?AW4MagicXEError@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@M@Z
?SetParam@AbstractParam@magic_xe@@UEAA?AW4MagicXEError@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z
MagicXEAlgorithmSupportedDetect

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

28cdbc1f0ca1a70c86db63083c113a44

Headers

DLL Characteristics

File Characteristics

Imports

magic_xe_module_wrap_rapidjson

magic_xe_kernel

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 45KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB