f88a5fd1af9829d4b51c45ec98dec844bbe327a658a12de715de4e688b7fa27a[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f88a5fd1af9829d4b51c45ec98dec844bbe327a658a12de715de4e688b7fa27a.exe
Size

1.1MB
MD5

9032a431c190f22ff5a9458b81d93c77
SHA1

c2c3c17588873141f113cb292ffd368cba7bb626
SHA256

f88a5fd1af9829d4b51c45ec98dec844bbe327a658a12de715de4e688b7fa27a
SHA512

24831aa9751105f595b1c1c71ae5f1dc54dd77aa2e8920911153889e89bae660d80456f4840bbe262e9347adcf7bf76cc73f16af234f89f54a30f15a1757fbc4
SSDEEP

24576:6Z7+q69d0eDDdPjPUbjgfiVrzFvVHmCkRYhT3bSGQn652l+JOsv8u2mWw:QhtbjgfigomNmJp8u2mWw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f88a5fd1af9829d4b51c45ec98dec844bbe327a658a12de715de4e688b7fa27a.exe

Files

f88a5fd1af9829d4b51c45ec98dec844bbe327a658a12de715de4e688b7fa27a.exe
.exe windows:6 windows x86 arch:x86

251d3404eb0425683c737712d63d3560

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxW

kernel32

GetFileInformationByHandle
SetHandleInformation
WakeConditionVariable
SleepConditionVariableSRW
GetCurrentThread
InitOnceBeginInitialize
WakeAllConditionVariable
InitOnceComplete
TlsFree
GetStdHandle
GetConsoleMode
GetModuleHandleA
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
WaitForSingleObjectEx
GetCurrentProcessId
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandleEx
Sleep
GetFullPathNameW
FindNextFileW
FindFirstFileW
FindClose
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetQueuedCompletionStatusEx
TryAcquireSRWLockExclusive
CreateThread
GetFinalPathNameByHandleW
TerminateProcess
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SwitchToThread
GetSystemTimes
GetProcessIoCounters
TlsSetValue
GetProcessTimes
ReadProcessMemory
TlsGetValue
LocalFree
VirtualQueryEx
HeapReAlloc
HeapFree
OpenProcess
GlobalMemoryStatusEx
K32GetPerformanceInfo
SetThreadStackGuarantee
AddVectoredExceptionHandler
WriteProcessMemory
GetCurrentProcess
VirtualProtect
GetProcAddress
PostQueuedCompletionStatus
LoadLibraryA
GetSystemInfo
LoadLibraryExA
FreeLibrary
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
IsProcessorFeaturePresent
CloseHandle
GetLastError
TlsAlloc
GetSystemTimeAsFileTime

pdh

PdhGetFormattedCounterValue
PdhCloseQuery
PdhRemoveCounter
PdhCollectQueryData
PdhOpenQueryA
PdhAddEnglishCounterW

ws2_32

recv
WSASend
WSASocketW
ioctlsocket
connect
closesocket
getsockopt
bind
getaddrinfo
WSAIoctl
freeaddrinfo
WSAStartup
WSACleanup
send
getsockname
WSAGetLastError
getpeername
shutdown
setsockopt

ntdll

NtReadFile
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtQueryInformationProcess
NtQuerySystemInformation
NtWriteFile
RtlGetVersion
NtCancelIoFileEx

secur32

FreeContextBuffer
InitializeSecurityContextW
DecryptMessage
ApplyControlToken
AcceptSecurityContext
DeleteSecurityContext
QueryContextAttributesW
AcquireCredentialsHandleA
FreeCredentialsHandle
EncryptMessage

crypt32

CertFreeCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateContext
CertOpenStore
CertGetCertificateChain
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertDuplicateStore
CertCloseStore
CertAddCertificateContextToStore
CertVerifyCertificateChainPolicy

advapi32

SystemFunction036
GetLengthSid
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
OpenProcessToken
IsValidSid
CopySid

bcrypt

BCryptGenRandom

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

shell32

CommandLineToArgvW

powrprof

CallNtPowerInformation

oleaut32

SysStringLen
SysFreeString
GetErrorInfo

vcruntime140

__current_exception_context
_except_handler4_common
memcpy
memset
__current_exception
memmove
memcmp
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow

api-ms-win-crt-runtime-l1-1-0

_initterm
_initialize_narrow_environment
_seh_filter_exe
_initterm_e
exit
_get_initial_narrow_environment
_exit
_c_exit
_set_app_type
__p___argc
__p___argv
_cexit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_onexit_table
terminate
_register_onexit_function
_crt_atexit
_controlfp_s

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 653KB - Virtual size: 653KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 411KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

251d3404eb0425683c737712d63d3560

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

pdh

ws2_32

ntdll

secur32

crypt32

advapi32

bcrypt

psapi

shell32

powrprof

oleaut32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 653KB - Virtual size: 653KB

.rdata Size: 411KB - Virtual size: 410KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 30KB - Virtual size: 29KB

.text
Size: 653KB - Virtual size: 653KB

.rdata
Size: 411KB - Virtual size: 410KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 29KB