d6c1f5202ed8e15bcf12c23b727d390b

Sharing

Copy URL Twitter E-mail

General

Target

d6c1f5202ed8e15bcf12c23b727d390b
Size

568KB
MD5

d6c1f5202ed8e15bcf12c23b727d390b
SHA1

831c4709cc306932b8992a0a97c6d508af421044
SHA256

34ee2e95b1546ac96dd24b5c4fd7650a9efba5d6427b03853e35444bacd55bef
SHA512

455f6dc200a12fd0a2ebf8d5725ddb19f6a9eb3d01b3a948e7aacb7c15df94ebac28d99a155791b801b2680147c073a08762100d7ca20f9562048a6b1cfd5d9d
SSDEEP

12288:y50bWze9MH8n9+ELjhu3yjlVHH8+UK4ak7N6C3UwpALm/8DI23Z:xbWwMcn9+qjA3yjlVHc/7N6C3TOLm/r8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6c1f5202ed8e15bcf12c23b727d390b

Files

d6c1f5202ed8e15bcf12c23b727d390b
.exe windows:10 windows x64 arch:x64

db6db794db9e5264490726992183fef7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

DeveloperToolsSvc.pdb

Imports

msvcrt

_exit
_unlock
calloc
exit
realloc
__setusermatherr
setlocale
free
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
swprintf_s
__pctype_func
isupper
__dllonexit
___lc_handle_func
___lc_codepage_func
wcscpy_s
sprintf_s
islower
strchr
__uncaught_exception
abort
__set_app_type
_amsg_exit
_XcptFilter
memmove
memcpy
_set_errno
strtol
_errno
strncpy_s
wcstombs
iswalpha
memset
_wcsdup
_CxxThrowException
_initterm
_cexit
iswdigit
?what@exception@@UEBAPEBDXZ
_lock
__wgetmainargs
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
_free_locale
??1exception@@UEAA@XZ
_get_current_locale
?terminate@@YAXXZ
_commode
__C_specific_handler
??1type_info@@UEAA@XZ
__crtLCMapStringA
_fmode
_onexit
memmove_s
_purecall
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoResumeClassObjects
StringFromGUID2
CoTaskMemAlloc
CoWaitForMultipleHandles
CoRevokeClassObject
CoTaskMemFree
CoDisconnectContext
CoCreateGuid
CoReleaseServerProcess
CoCreateInstance
CoInitializeSecurity
CoAddRefServerProcess
CoRegisterClassObject

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
CreateMutexExW
DeleteCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
CreateEventW
ReleaseMutex
CreateSemaphoreExW
SetEvent
InitializeCriticalSectionEx
CreateEventExW
OpenSemaphoreW
WaitForSingleObject
ReleaseSemaphore
WaitForSingleObjectEx
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
HeapSize
GetProcessHeap
HeapDestroy
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsDeleteString
WindowsConcatString
WindowsDuplicateString
WindowsStringHasEmbeddedNull

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
OpenThreadToken
CreateProcessAsUserW
OpenProcessToken
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoRegisterActivationFactories
RoInitialize
RoUninitialize
RoRevokeActivationFactories
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
InitializeSid
CopySid
RevertToSelf
GetSecurityDescriptorDacl
CreateWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSidLengthRequired
AddAccessAllowedAce
InitializeAcl
GetSidSubAuthority
EqualSid
DuplicateTokenEx
MakeAbsoluteSD
DuplicateToken
GetTokenInformation
IsValidSid
GetLengthSid

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-appmodel-unlock-l1-1-0

IsDeveloperModeEnabled

api-ms-win-core-toolhelp-l1-1-0

Process32NextW
Process32FirstW
CreateToolhelp32Snapshot

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

srvcli

NetShareAdd
NetShareDelEx
NetShareGetInfo

api-ms-win-core-file-l1-1-0

DeleteFileW
CreateDirectoryW
CreateFileW
SetFilePointer
GetFileAttributesW
ReadFile
WriteFile

netutils

NetApiBufferFree

rpcrt4

UuidCreate

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventActivityIdControl
EventSetInformation

userenv

CreateProfile
CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW

api-ms-win-security-credentials-l1-1-0

CredWriteW
CredFree
CredReadW
CredDeleteW

samcli

NetUserSetInfo
NetUserAdd
NetUserGetInfo
NetLocalGroupAddMembers
NetUserDel

sspicli

LogonUserExExW

api-ms-win-eventing-controller-l1-1-0

EventAccessControl
EventAccessQuery

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW
GetExplicitEntriesFromAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

api-ms-win-security-lsapolicy-l1-1-0

LsaAddAccountRights
LsaClose
LsaOpenPolicy

cryptsp

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-appmodel-runtime-l1-1-0

GetApplicationUserModelId

api-ms-win-appmodel-runtime-l1-1-1

ParseApplicationUserModelId
FindPackagesByPackageFamily

ntdll

RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku

firewallapi

FWOpenPolicyStore
FWClosePolicyStore
FWAddFirewallRule

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 400KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db6db794db9e5264490726992183fef7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-appmodel-unlock-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-lsalookup-l2-1-0

srvcli

api-ms-win-core-file-l1-1-0

netutils

rpcrt4

api-ms-win-eventing-provider-l1-1-0

userenv

api-ms-win-core-registry-l1-1-0

api-ms-win-security-credentials-l1-1-0

samcli

sspicli

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

cryptsp

api-ms-win-core-apiquery-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-appmodel-runtime-l1-1-1

ntdll

firewallapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 113KB - Virtual size: 112KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 112B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 400KB - Virtual size: 1.1MB

.text
Size: 113KB - Virtual size: 112KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 112B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 400KB - Virtual size: 1.1MB