d5bdd4ddd79ef9950e57ab0acdbb5197

Sharing

Copy URL Twitter E-mail

General

Target

d5bdd4ddd79ef9950e57ab0acdbb5197
Size

798KB
MD5

d5bdd4ddd79ef9950e57ab0acdbb5197
SHA1

e2d81576b6e625898c6dec53dbf713cd8b5fabb2
SHA256

3f314313a28d3df32597530774f12fede7ba69bfa073bde81f86e88bc56e9bde
SHA512

c31dc2fbacb1dd0fc295b9cde5b944b4fd8876441ec6c523429512cf12e070e6c8daed6a0dc273382e0c9d9f59bc978c9b59b7124bf4fcd7cd3caf3d30276bc3
SSDEEP

24576:RPBPK7bjh8VQJgaszKV6Zocff/PYwl/zy:lgIQgzKV6BfXT5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5bdd4ddd79ef9950e57ab0acdbb5197

Files

d5bdd4ddd79ef9950e57ab0acdbb5197
.exe windows:10 windows x64 arch:x64

a85e93460c5e8e748a45a6e13a31105e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TabTip.pdb

Imports

user32

MessageBoxW
CharNextW
GetForegroundWindow
GetAncestor
RealGetWindowClassW
GetUserObjectInformationW
OpenInputDesktop
CloseDesktop
SetProcessDPIAware
GetSystemMetrics
FindWindowW
KillTimer
SetWinEventHook
UnhookWinEvent
GetClassNameW
SendInput
GetWindowThreadProcessId
GetKeyboardLayout
MapVirtualKeyExW
MapVirtualKeyW
WaitForInputIdle
GetDlgCtrlID
GetWindow
SetTimer
PostMessageW
PostThreadMessageW
DispatchMessageW
GetMessageW
TranslateMessage
SetThreadDesktop
CharUpperW
UnregisterClassA
GetThreadDesktop

msvcrt

memcpy
memcmp
_CxxThrowException
__CxxFrameHandler3
__C_specific_handler
malloc
free
??1exception@@UEAA@XZ
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
memset
_XcptFilter
_callnewh
wcsncmp
vswprintf_s
_vscwprintf
_wtoi
iswspace
wcsrchr
towupper
_purecall
calloc
wcstol
_wcsnicmp
qsort
wcschr
_itow
??0exception@@QEAA@AEBV0@@Z
_vsnwprintf
memcpy_s
_beginthreadex
wcsstr
_wcsicmp
memmove_s
??0exception@@QEAA@XZ
_vsnprintf_s
_amsg_exit
wcscmp

ntdll

NtQuerySystemInformation
EtwEventUnregister
EtwEventRegister
EtwEventSetInformation
EtwEventWriteTransfer
EtwEventActivityIdControl
WinSqmAddToStream
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPublishWnfStateData

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
OpenMutexW
CreateMutexW
ReleaseMutex
CreateEventW
DeleteCriticalSection
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateSemaphoreExW
OpenEventW
OpenSemaphoreW
SetEvent
WaitForSingleObjectEx
ReleaseSRWLockShared
InitializeCriticalSectionEx
WaitForMultipleObjectsEx

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
FreeLibrary

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

ProcessIdToSessionId
GetCurrentThreadId
CreateProcessAsUserW
GetCurrentThread
OpenProcessToken
TerminateProcess
OpenThreadToken
SetProcessShutdownParameters
GetStartupInfoW
GetCurrentProcess
GetExitCodeProcess
GetCurrentProcessId
CreateThread

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapDestroy
HeapAlloc
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-security-base-l1-1-0

EqualSid
InitializeAcl
AddAce
GetAclInformation
GetSecurityDescriptorOwner
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetTokenInformation
IsValidSid
InitializeSecurityDescriptor
GetSidLengthRequired
MakeAbsoluteSD
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
DuplicateTokenEx
GetSecurityDescriptorGroup

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-psapi-l1-1-0

K32EnumProcessModules
K32EnumProcesses
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
K32GetModuleBaseNameW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
OpenProcess

api-ms-win-core-file-l1-1-0

CompareFileTime
CreateFileW
GetFileTime

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathFindFileNameW

kernel32

UnregisterApplicationRestart
RegisterApplicationRestart

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 400KB - Virtual size: 740KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a85e93460c5e8e748a45a6e13a31105e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcrt

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

kernel32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 272KB - Virtual size: 271KB

.imrsiv Size: - Virtual size: 4B

.rdata Size: 66KB - Virtual size: 66KB

.data Size: 1KB - Virtual size: 5KB

.pdata Size: 12KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 368B

.rsrc Size: 45KB - Virtual size: 45KB

.reloc Size: 400KB - Virtual size: 740KB

.text
Size: 272KB - Virtual size: 271KB

.imrsiv
Size: - Virtual size: 4B

.rdata
Size: 66KB - Virtual size: 66KB

.data
Size: 1KB - Virtual size: 5KB

.pdata
Size: 12KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 368B

.rsrc
Size: 45KB - Virtual size: 45KB

.reloc
Size: 400KB - Virtual size: 740KB