6cc594d8c84a422dfdd848a60c10bc80f2529ef0b99eae76243aa18c784cb9de

Sharing

Copy URL Twitter E-mail

General

Target

6cc594d8c84a422dfdd848a60c10bc80f2529ef0b99eae76243aa18c784cb9de
Size

2.1MB
MD5

ca50f0819d7d8a1d7dfc6dab92dc9b5d
SHA1

48d57edaf9b55471b2702d58e442af9dfee53add
SHA256

6cc594d8c84a422dfdd848a60c10bc80f2529ef0b99eae76243aa18c784cb9de
SHA512

62f98b426eadeca1e1f0edb58c93e7b167db14dd3375d6c7265788203f17fb549db16038b523791851221e3a54fa808fc7cf0b851a72469ab33961eaec9dac8d
SSDEEP

49152:FlrNanljQjPVqJ2khDYbjcoxIXwZIU6iz0gvq:3WMkDqe+Qgv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6cc594d8c84a422dfdd848a60c10bc80f2529ef0b99eae76243aa18c784cb9de

Files

6cc594d8c84a422dfdd848a60c10bc80f2529ef0b99eae76243aa18c784cb9de
.exe windows:6 windows x64 arch:x64

06c60302013287ea609ce8a90c15aa52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

PostMessageA
FindWindowA

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036
GetTokenInformation
OpenProcessToken

kernel32

TlsSetValue
TlsFree
LoadLibraryExW
InitializeSListHead
RtlPcToFileHeader
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RtlVirtualUnwind
GetCurrentProcess
LoadLibraryExA
GetProcAddress
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
GetLastError
WaitForSingleObject
FormatMessageW
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
Sleep
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
DuplicateHandle
GetStdHandle
GetCurrentProcessId
SetHandleInformation
WriteFileEx
SleepEx
TerminateProcess
QueryPerformanceFrequency
HeapReAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
CopyFileExW
GetConsoleMode
GetModuleHandleW
GetModuleFileNameW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetFullPathNameW
GetModuleHandleA
GetSystemTimeAsFileTime
GetTempPathW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
IsDebuggerPresent
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
DeleteCriticalSection
RaiseException
EncodePointer
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetCurrentThreadId

bcrypt

BCryptGenRandom

ws2_32

ioctlsocket
accept
send
WSASend
WSADuplicateSocketW
WSARecv
WSASocketW
getaddrinfo
connect
select
bind
listen
getsockname
WSACleanup
recv
getsockopt
setsockopt
closesocket
WSAGetLastError
freeaddrinfo
getpeername
WSAStartup

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity

oleaut32

SysStringLen
SafeArrayDestroy
VariantClear
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
SysFreeString
SysAllocStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress

ntdll

RtlNtStatusToDosError
NtWriteFile

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp

api-ms-win-crt-runtime-l1-1-0

__p___argv
__p___argc
_c_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_exit
_set_app_type
_register_onexit_function
_seh_filter_exe
abort
_register_thread_local_exe_atexit_callback
terminate
_cexit
_crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
calloc
malloc

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 771KB - Virtual size: 770KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06c60302013287ea609ce8a90c15aa52

Headers

DLL Characteristics

File Characteristics

Imports

user32

bcryptprimitives

advapi32

kernel32

bcrypt

ws2_32

ole32

oleaut32

api-ms-win-core-synch-l1-2-0

ntdll

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 771KB - Virtual size: 770KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 29KB - Virtual size: 28KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 771KB - Virtual size: 770KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 29KB - Virtual size: 28KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 9KB - Virtual size: 8KB