e181b801776fcbc14df7ffbef1e810df

Sharing

Copy URL

Twitter E-mail

General

Target

e181b801776fcbc14df7ffbef1e810df
Size

65KB
MD5

e181b801776fcbc14df7ffbef1e810df
SHA1

c07d3a036e1fa7df8255365bbbab5d3e75306210
SHA256

0618b5a0d33768801908c63dbd1d2d1ebd442395af8d5866b5158339f021e00e
SHA512

959c0c05cb90b4a884f9904f876bc3143fe80b4bb6ee5547d86ffdf255c46d1b583423775da671d1d8a942f50ce0fc7b91782f7554fc088ca384a9f4ea35ab1d
SSDEEP

1536:/Frsutb/kF2dhM0LXVBoRM2/mKGXi3ITGIDicFoZNU2mqySDS:/xseu2djXvovmKwi33IecFoAq3D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e181b801776fcbc14df7ffbef1e810df

Files

e181b801776fcbc14df7ffbef1e810df
.exe windows:6 windows x86 arch:x86

227d81c5224c7437ae46e793d9114b4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

unsecapp.pdb

Imports

msvcrt

_vsnwprintf
printf
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
wcsstr
_amsg_exit
_purecall
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
malloc
_callnewh
free
??0exception@@QAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
memmove_s
memcpy_s
__CxxFrameHandler3
__setusermatherr

wbemcomn

??0CCritSec@@QAE@XZ
??1CCritSec@@QAE@XZ
?_ThrowMemoryException_@@YGXXZ
?ErrorTrace@@YAHDPBDZZ
??0CNtSid@@QAE@W4SidType@0@@Z
??1Registry@@QAE@XZ
??8CNtSid@@QAEHAAV0@@Z
?GetTextSid@CNtSid@@QAEHPAGPAK@Z
??1CInCritSec@@QAE@XZ
?GetDWORDStr@Registry@@QAEHPBGPAK@Z
??0Registry@@QAE@PBGK@Z
??0CNtSid@@QAE@PAX@Z
?InternalQueryInterface@CUnkInternal@@QAEJABU_GUID@@PAPAX@Z
?InternalRelease@CUnkInternal@@QAEKXZ
?Write@CMemoryLog@@QAEXJ@Z
?GetMemLogObject@@YGPAVCMemoryLog@@XZ
??0CInCritSec@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
??0CNtSid@@QAE@ABV0@@Z
??4CNtSid@@QAEAAV0@ABV0@@Z
?Initialize@CUnk@@UAEHXZ
?OnInitialize@CUnk@@UAEHXZ
?Release@CUnk@@UAGKXZ
?AddRef@CUnk@@UAGKXZ
?QueryInterface@CUnk@@UAGJABU_GUID@@PAPAX@Z
??0CUnk@@QAE@PAVCLifeControl@@PAUIUnknown@@@Z
??1CUnk@@UAE@XZ
?Release@CUnkInternal@@UAGKXZ
?AddRef@CUnkInternal@@UAGKXZ
?QueryInterface@CUnkInternal@@UAGJABU_GUID@@PAPAX@Z
??0CUnkInternal@@QAE@PAVCLifeControl@@@Z
??_7CUnkInternal@@6B@
??1CUnkInternal@@UAE@XZ
??1CNtSid@@QAE@XZ

ntdll

EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceEnableLevel

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CreateServiceW
OpenServiceW
DeleteService

kernel32

InterlockedIncrement
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
LeaveCriticalSection
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
DebugBreak
LCMapStringW
EnterCriticalSection
ExitProcess
SetEvent
LoadLibraryExW
GetLastError
CreateEventW
GetModuleFileNameW
lstrlenW
GetCommandLineW
DeleteCriticalSection
InterlockedDecrement
GetCurrentProcessId
GetProcAddress
InterlockedExchange

ole32

CoImpersonateClient
CoRegisterClassObject
CoRevokeClassObject
StringFromGUID2
CoRevertToSelf
CoInitialize
CoInitializeSecurity

api-ms-win-security-base-l1-1-0

EqualSid
GetLengthSid
IsValidSid

user32

DispatchMessageW
TranslateMessage
GetMessageW
PostQuitMessage
SetTimer
PostThreadMessageW

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

onjztes
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

227d81c5224c7437ae46e793d9114b4d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

wbemcomn

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l1-1-0

kernel32

ole32

api-ms-win-security-base-l1-1-0

user32

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 30KB - Virtual size: 31KB

onjztes Size: - Virtual size: 4KB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 31KB

onjztes
Size: - Virtual size: 4KB