2aaff6b14f9f9028f24d0ba1cda730029e6a9aee93d1c675b63ff6b46361b3e4

Sharing

Copy URL

Twitter E-mail

General

Target

2aaff6b14f9f9028f24d0ba1cda730029e6a9aee93d1c675b63ff6b46361b3e4
Size

81KB
MD5

e96ca2aa7c6951802e4b17649cc5b581
SHA1

ba9e7adf807a5d90de84851aaf211aac0d1c3634
SHA256

2aaff6b14f9f9028f24d0ba1cda730029e6a9aee93d1c675b63ff6b46361b3e4
SHA512

55a726b56bc3f0d811ee7ea815286f4499a45812a003ce6e49eadf31906d5f354ab29ad1d916389672f9178e3b1864b46a5e86488e4e90ec66223bb5d6a83c17
SSDEEP

1536:1Xv4d/8OZpr3SpyeOvyM2TCWv92mmsj6N8CRE8aRVJTfTJ5rNrIq:B4d/L13Spep2T3v9TmdRmRXTfTuq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2aaff6b14f9f9028f24d0ba1cda730029e6a9aee93d1c675b63ff6b46361b3e4

Files

2aaff6b14f9f9028f24d0ba1cda730029e6a9aee93d1c675b63ff6b46361b3e4
.exe windows:5 windows x64 arch:x64

64dcb51bf36bc75d1670de63e478b7ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OpenMutexA
CreateMutexA
GetModuleFileNameA
CreateEventA
WaitForSingleObject
CreateThread
TerminateThread
SetEvent
LoadLibraryA
GetProcAddress
GetModuleHandleA
OpenProcess
WideCharToMultiByte
GetModuleHandleW
CreateRemoteThread
VirtualFreeEx
Sleep
GetModuleFileNameW
VirtualAllocEx
GetExitCodeThread
WriteProcessMemory
CreateFileA
SetFilePointer
WriteFile
CreateFileW
WriteConsoleW
SetStdHandle
LoadLibraryW
GetCurrentProcessId
ProcessIdToSessionId
CloseHandle
GetLastError
GetCurrentProcess
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCommandLineW
GetStartupInfoW
RaiseException
RtlPcToFileHeader
GetCPInfo
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
FlushFileBuffers

user32

wsprintfA

advapi32

InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetSecurityDescriptorDacl

shlwapi

PathRemoveFileSpecA
PathAppendA

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemory
WTSLogoffSession
WTSQuerySessionInformationA

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64dcb51bf36bc75d1670de63e478b7ff

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

wtsapi32

Sections

.text Size: 49KB - Virtual size: 48KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 5KB - Virtual size: 15KB

.pdata Size: 3KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 49KB - Virtual size: 48KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 5KB - Virtual size: 15KB

.pdata
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB