b41019b9d5eb5a89a1e4941cd18334a861eef66e316b8ef8ee1e5b7608ecfec6

Sharing

Copy URL Twitter E-mail

General

Target

b41019b9d5eb5a89a1e4941cd18334a861eef66e316b8ef8ee1e5b7608ecfec6
Size

1.4MB
MD5

129fcc419c9089d35f1fe7ea74f82f58
SHA1

25e2065e7a3d4debfe95f086093fbc3c678829c1
SHA256

b41019b9d5eb5a89a1e4941cd18334a861eef66e316b8ef8ee1e5b7608ecfec6
SHA512

daf6139b4afcb347a66d0fa122acd9f914db516b9b82cd92c7a11e924d4b64971757541d2fc5981dfdd312ea01a802584587b38dd3c66643674a3f8b2ddba560
SSDEEP

24576:DlMKTYy47LMLu3J8NuZKLbEuWeaea14ecsZSyaXLlQn652cObchQA+7:p7TYyQb8NukMuWPea14ecsZTgguVhQB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b41019b9d5eb5a89a1e4941cd18334a861eef66e316b8ef8ee1e5b7608ecfec6

Files

b41019b9d5eb5a89a1e4941cd18334a861eef66e316b8ef8ee1e5b7608ecfec6
.exe windows:6 windows x64 arch:x64

65af09ca113fe8a3d1fca443d29d4ee7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtWriteFile
RtlVirtualUnwind

kernel32

GetConsoleMode
SetFileCompletionNotificationModes
MultiByteToWideChar
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
CreateFileW
GetFullPathNameW
FindNextFileW
CreateDirectoryW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateIoCompletionPort
GetQueuedCompletionStatusEx
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetModuleFileNameW
GetSystemDirectoryW
GetCurrentThread
CreateProcessW
GetFileAttributesW
DuplicateHandle
IsProcessorFeaturePresent
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GetFinalPathNameByHandleW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
AcquireSRWLockShared
ReleaseSRWLockShared
PostQueuedCompletionStatus
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStdHandle
SwitchToThread
AcquireSRWLockExclusive
HeapReAlloc
SetHandleInformation
HeapFree
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetSystemInfo
Sleep
GetModuleHandleA
GetProcAddress
CloseHandle
FindClose
TerminateProcess
GetLastError
FindFirstFileW
IsDebuggerPresent
GetWindowsDirectoryW
SetUnhandledExceptionFilter
CompareStringOrdinal
WaitForSingleObject

crypt32

CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertDuplicateStore
CertGetCertificateChain
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertVerifyCertificateChainPolicy
CertFreeCertificateChain

ws2_32

setsockopt
connect
WSASocketW
WSASend
shutdown
getsockopt
bind
getaddrinfo
freeaddrinfo
WSAStartup
closesocket
recv
send
ioctlsocket
WSAIoctl
getsockname
WSAGetLastError
getpeername
WSACleanup

secur32

FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
EncryptMessage
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
QueryContextAttributesW
AcquireCredentialsHandleA
ApplyControlToken

advapi32

RegQueryValueExW
RegOpenKeyExW
SystemFunction036
RegCloseKey

bcrypt

BCryptGenRandom

vcruntime140

memcpy
__CxxFrameHandler3
memmove
memcmp
__C_specific_handler
__current_exception
__current_exception_context
memset

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_cexit
_c_exit
_set_app_type
__p___argv
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_initterm_e
_initterm
terminate
_initialize_onexit_table
exit
_exit
_register_onexit_function
_configure_narrow_argv
__p___argc
_crt_atexit
_seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 885KB - Virtual size: 884KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 467KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65af09ca113fe8a3d1fca443d29d4ee7

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

crypt32

ws2_32

secur32

advapi32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 885KB - Virtual size: 884KB

.rdata Size: 467KB - Virtual size: 466KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 31KB - Virtual size: 30KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 885KB - Virtual size: 884KB

.rdata
Size: 467KB - Virtual size: 466KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 31KB - Virtual size: 30KB

.reloc
Size: 7KB - Virtual size: 6KB