df050f44c13a60f8e05903c3c0fa60f5

Sharing

Copy URL Twitter E-mail

General

Target

df050f44c13a60f8e05903c3c0fa60f5
Size

1.8MB
MD5

df050f44c13a60f8e05903c3c0fa60f5
SHA1

2fd0fd8f6151561adfc8628a3dd84708f28550ed
SHA256

64023b5c8daa266296bed52a5ef5598579a0e4793ae319b69d15732da24cdec4
SHA512

e56ea5b3e456c5ba2f6157a10bf43d085cfca8028af4f2809e53695bde77f0ebb05c7fa90f9aa180340209d27d71ec1a842461dc44a7509b6566ee147273c79c
SSDEEP

24576:QFKNSS7SIfKLQHJ2ochrLlqMoy6nV925+P7QCPU3uhfhXVPSKot:/XS5QH8om/lqMoy6nV99Pjvo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df050f44c13a60f8e05903c3c0fa60f5

Files

df050f44c13a60f8e05903c3c0fa60f5
.exe windows:10 windows x64 arch:x64

bc4180ead977aaf92baa2185cc3d84e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vssvc.pdb

Imports

msvcrt

iswdigit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
?what@exception@@UEBAPEBDXZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
wcsstr
__dllonexit
qsort
_onexit
wcsrchr
wcstok
_errno
_beginthreadex
_vsnprintf
memset
wcsncmp
_wcsicmp
_wcsnicmp
_purecall
wcscat_s
_vsnprintf_s
malloc
realloc
free
??0exception@@QEAA@XZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
iswspace
towupper
memmove
memcpy
memcmp
_vscwprintf
wcstoul
wcscmp
??1exception@@UEAA@XZ
_vsnwprintf
__C_specific_handler
__CxxFrameHandler3

oleaut32

VariantInit
VariantCopy
VariantClear
SysAllocStringLen
VarUI4FromStr
LoadRegTypeLi
SysStringLen
GetErrorInfo
SysAllocString
SysFreeString
VariantChangeType

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-1-0

CreateMutexExW
CancelWaitableTimer
SetWaitableTimer
LeaveCriticalSection
SetEvent
InitializeCriticalSectionAndSpinCount
CreateEventW
WaitForSingleObjectEx
CreateWaitableTimerExW
EnterCriticalSection
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSection
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjectsEx
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
OpenThread
ResumeThread
OpenThreadToken
GetCurrentProcess
SetThreadPriority
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess
GetStartupInfoW
GetCurrentThread

api-ms-win-core-com-l1-1-0

CoGetObjectContext
CoSetProxyBlanket
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoDisconnectContext
CoTaskMemRealloc
CoRevertToSelf
CoImpersonateClient
CoCreateGuid
CLSIDFromString
CoGetClassObject
CoTaskMemAlloc
CoInitializeSecurity
CoInitializeEx
StringFromCLSID
CoFreeUnusedLibraries
CoUninitialize
CoCreateInstance

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount64
GetComputerNameExW
GetSystemInfo

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSetInformation
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
GetModuleFileNameA
GetProcAddress
LoadResource
LoadStringW
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
SizeofResource
FreeLibrary
GetModuleHandleW

api-ms-win-core-string-l2-1-0

CharNextW
CharPrevW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcpynW

ntdll

RtlNtStatusToDosError
RtlAdjustPrivilege
EtwTraceMessage
NtThawRegistry
NtFreezeRegistry
NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
NtThawTransactions
NtFreezeTransactions
NtQuerySystemInformation
RtlNtStatusToDosErrorNoTeb
NtQueryVolumeInformationFile
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

FindFirstVolumeW
FindNextVolumeW
FlushFileBuffers
GetDiskFreeSpaceW
FindFirstFileW
CreateDirectoryW
SetFileAttributesW
WriteFile
GetFileAttributesW
DeleteVolumeMountPointW
DeleteFileW
ReadFile
CreateFileW
DefineDosDeviceW
GetVolumeInformationW
FindNextFileW
FindClose
GetVolumePathNameW
QueryDosDeviceW
FindVolumeClose
GetDriveTypeW

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
FreeSid
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
PrivilegeCheck
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
CreateWellKnownSid
EqualSid
SetSecurityDescriptorOwner
CopySid
SetSecurityDescriptorGroup
GetAclInformation
GetAce
AddAce
AddAccessDeniedAceEx
AddAccessAllowedAceEx
IsValidSid
AccessCheck
GetSidSubAuthorityCount
EqualDomainSid
GetTokenInformation
InitializeSecurityDescriptor
AdjustTokenPrivileges

api-ms-win-core-kernel32-legacy-l1-1-1

SetVolumeMountPointW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

rpcrt4

I_RpcBindingInqLocalClientPID
UuidToStringW
RpcStringFreeW

devobj

DevObjEnumDeviceInfo
DevObjDestroyDeviceInfoList
DevObjUninstallDevice
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjGetDeviceRegistryProperty

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-service-private-l1-1-0

I_ScRegisterDeviceNotification
I_ScUnregisterDeviceNotification

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

vssapi

CreateWriterEx
VssFreeSnapshotPropertiesInternal
CreateVssSnapshotSetDescription
LoadVssSnapshotSetDescription
CreateWriter

vsstrace

ord2
ord4
ord7
ord5
ord11
ord1
ord10
ord9
ord3
ord6
ord8

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW
ReportEventW

authz

AuthzUnregisterSecurityEventSource
AuthzReportSecurityEventFromParams
AuthzRegisterSecurityEventSource

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

virtdisk

GetStorageDependencyInformation

bcd

BcdForciblyUnloadStore
BcdCloseObject
BcdGetElementData
BcdOpenSystemStore
BcdCloseStore
BcdOpenObject

api-ms-win-core-util-l1-1-0

EncodePointer

Sections

.text
Size: 950KB - Virtual size: 950KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 396KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc4180ead977aaf92baa2185cc3d84e3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-eventing-provider-l1-1-0

rpcrt4

devobj

api-ms-win-core-file-l2-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

vssapi

vsstrace

api-ms-win-eventlog-legacy-l1-1-0

authz

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

virtdisk

bcd

api-ms-win-core-util-l1-1-0

Sections

.text Size: 950KB - Virtual size: 950KB

.rdata Size: 408KB - Virtual size: 408KB

.data Size: 1KB - Virtual size: 5KB

.pdata Size: 29KB - Virtual size: 28KB

.didat Size: 512B - Virtual size: 336B

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 396KB - Virtual size: 736KB

.text
Size: 950KB - Virtual size: 950KB

.rdata
Size: 408KB - Virtual size: 408KB

.data
Size: 1KB - Virtual size: 5KB

.pdata
Size: 29KB - Virtual size: 28KB

.didat
Size: 512B - Virtual size: 336B

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 396KB - Virtual size: 736KB