ed3ff1f754b5e7dc9b2fafa5640c1e2eae7bc0a48e15374011423516bb75ae2d

Sharing

Copy URL Twitter E-mail

General

Target

ed3ff1f754b5e7dc9b2fafa5640c1e2eae7bc0a48e15374011423516bb75ae2d
Size

2.7MB
MD5

c41ba0e261c322d11c7026ea78864dad
SHA1

bc2c1ea0809f0b03a83d2ed05a837ffc1daafdef
SHA256

ed3ff1f754b5e7dc9b2fafa5640c1e2eae7bc0a48e15374011423516bb75ae2d
SHA512

312f1dcb57bb967f587d586cfb1161bfb94f086a75226e9d0756e9af7876f5265b23601760b4e219c42432ce91aef0b2439a8b4125bdcd3d98bcf51cdf518fae
SSDEEP

49152:ftI/xcH4L/NFREAP8qSRyqWPOZsm8qBEr/JR5Z70PS+:fMV+Wqq70

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed3ff1f754b5e7dc9b2fafa5640c1e2eae7bc0a48e15374011423516bb75ae2d

Files

ed3ff1f754b5e7dc9b2fafa5640c1e2eae7bc0a48e15374011423516bb75ae2d
.exe windows:6 windows x64 arch:x64

cf219d109bcc8dc0fb93126c856cdc56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcryptprimitives

ProcessPrng

kernel32

SetHandleInformation
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetCurrentThreadId
SetFileCompletionNotificationModes
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
IsDebuggerPresent
UnhandledExceptionFilter
lstrlenW
SetUnhandledExceptionFilter
VirtualProtect
GetCurrentThread
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
MapViewOfFile
CreateFileMappingW
GetStdHandle
GetCurrentProcessId
UnmapViewOfFile
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
HeapFree
GetSystemInfo
HeapReAlloc
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
FindFirstFileW
GetFinalPathNameByHandleW
FlushInstructionCache
WriteProcessMemory
GetConsoleMode
GetProcAddress
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WriteConsoleW
CreateThread
GetFullPathNameW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
GetCurrentProcess
CloseHandle
LocalFree
IsProcessorFeaturePresent

secur32

InitializeSecurityContextW
DecryptMessage
AcquireCredentialsHandleA
AcceptSecurityContext
FreeCredentialsHandle
DeleteSecurityContext
QueryContextAttributesW
FreeContextBuffer
EncryptMessage
ApplyControlToken

advapi32

RegCloseKey
SystemFunction036
RegOpenKeyExW
RegQueryValueExW

ws2_32

WSASend
recv
shutdown
getpeername
getsockopt
ioctlsocket
connect
bind
WSASocketW
WSAGetLastError
setsockopt
WSAStartup
WSAIoctl
WSACleanup
getsockname
freeaddrinfo
closesocket
getaddrinfo
send

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateCertificateContext
CertDuplicateStore
CertFreeCertificateContext

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile
NtCreateFile

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

vcruntime140

__current_exception_context
__current_exception
__CxxFrameHandler3
memcpy
memmove
memcmp
memset
_CxxThrowException
__C_specific_handler

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_exit
_configure_narrow_argv
__p___argc
__p___argv
_cexit
_c_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 924KB - Virtual size: 924KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf219d109bcc8dc0fb93126c856cdc56

Headers

DLL Characteristics

File Characteristics

Imports

bcryptprimitives

kernel32

secur32

advapi32

ws2_32

crypt32

ntdll

shell32

ole32

bcrypt

api-ms-win-core-synch-l1-2-0

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 924KB - Virtual size: 924KB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 88KB - Virtual size: 88KB

.rsrc Size: 1024B - Virtual size: 840B

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 924KB - Virtual size: 924KB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 88KB - Virtual size: 88KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 17KB - Virtual size: 17KB