59986e20e03774c7d0f5adb4eca394f5f51b01a8c2ba9cb6c1ce30f9312b9566

Sharing

Copy URL Twitter E-mail

General

Target

59986e20e03774c7d0f5adb4eca394f5f51b01a8c2ba9cb6c1ce30f9312b9566
Size

717KB
MD5

e817741543b7a2d3e1b192a64ff6cd9d
SHA1

d2be7ec36b18160e1af1b3e1249927a0e3622646
SHA256

59986e20e03774c7d0f5adb4eca394f5f51b01a8c2ba9cb6c1ce30f9312b9566
SHA512

7504c5e5026c655211084f8cc479054c1d04f6255a8e5d7cf16cfbe123fe7e2c7c0b71254c652bc90ce8cc965b7dfa8a385678cda02ee1f9ffa356ebeef53ca7
SSDEEP

12288:4Hf9MN7EgAeVAvnc9igGJsaUFIMvCQCyb8DB:4Hf9MN7W+AvncMJBUF5vfCyuB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59986e20e03774c7d0f5adb4eca394f5f51b01a8c2ba9cb6c1ce30f9312b9566

Files

59986e20e03774c7d0f5adb4eca394f5f51b01a8c2ba9cb6c1ce30f9312b9566
.dll windows:10 windows x64 arch:x64

7a5568fc7cb4c4a1c333fccb0a844c7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

computecore.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__isctype
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__stricmp
_o__ui64tow_s
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wtof
_o__wtoi64
_o_free
_o_isalnum
_o_isdigit
_o_ispunct
_o_iswalpha
_o_iswascii
_o_malloc
_o_strcpy_s
_o_terminate
_o_towupper
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstoul
_CxxThrowException
_o__execute_onexit_table
_o__errno
wcsstr
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__crt_atexit
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__wcstoui64
_o__callnewh
__std_terminate
__C_specific_handler
__CxxFrameHandler3
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
CreateEventW
InitializeCriticalSection
CreateEventExW
ResetEvent
InitializeSRWLock
ReleaseSemaphore
WaitForSingleObject
SetEvent
ReleaseMutex
ReleaseSRWLockExclusive
CreateSemaphoreExW
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx

api-ms-win-core-synch-l1-2-0

WaitOnAddress
InitOnceComplete
WakeByAddressAll
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
Sleep
InitializeConditionVariable

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
RtlVirtualUnwind
RtlCaptureStackBackTrace

api-ms-win-eventing-provider-l1-1-0

EventEnabled
EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventRegister
EventWrite

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegGetValueW
RegQueryValueExW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-com-l1-1-0

CoDisableCallCancellation
CoEnableCallCancellation
CoCancelCall
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWait
CreateThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CallbackMayRunLong
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer

rpcrt4

RpcBindingFree
UuidCompare
RpcBindingBind
NdrClientCall3
UuidCreate
RpcBindingCreateW
RpcExceptionFilter
UuidFromStringW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-security-base-l1-1-0

GetLengthSid
InitializeSid
GetSidLengthRequired
CheckTokenMembership
CreateWellKnownSid
GetSidSubAuthority
GetSecurityDescriptorDacl
CopySid

api-ms-win-security-provider-l1-1-0

SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW

api-ms-win-security-trustee-l1-1-0

BuildTrusteeWithSidW

mpr

WNetGetResourceInformationW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
DeleteFileW
SetFileTime
SetEndOfFile
CompareFileTime
GetFileSizeEx
GetFileTime
GetFinalPathNameByHandleW
LockFileEx
SetFilePointerEx
GetFileAttributesW
GetDiskFreeSpaceW
GetFileInformationByHandle
UnlockFileEx
ReadFile
CreateFileW
FlushFileBuffers
WriteFile

bcrypt

BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsUNCServerShareW
PathRemoveFileSpecW
PathSkipRootW
PathIsUNCServerW
PathIsRelativeW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar

ntdll

RtlFreeUnicodeString
RtlNtStatusToDosError
RtlInitUnicodeStringEx
RtlAllocateHeap
RtlInitUnicodeString
NtOpenJobObject
RtlFreeHeap
RtlDosPathNameToNtPathName_U_WithStatus
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtCreateFile

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SysAllocString
VariantInit
SafeArrayCreateVector
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
SysFreeString

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-path-l1-1-0

PathCchAddBackslash
PathCchRemoveFileSpec

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult
CancelIoEx

xmllite

CreateXmlReader
CreateXmlReaderInputWithEncodingName
CreateXmlWriter
CreateXmlWriterOutputWithEncodingName

api-ms-win-core-io-l1-1-1

GetOverlappedResultEx

combase

ord139

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

HcsCancelOperation
HcsCloseComputeSystem
HcsCloseOperation
HcsCloseProcess
HcsCreateComputeSystem
HcsCreateEmptyGuestStateFile
HcsCreateEmptyRuntimeStateFile
HcsCreateOperation
HcsCreateProcess
HcsEnumerateComputeSystems
HcsEnumerateVmWorkerProcesses
HcsFindVmWorkerProcesses
HcsGetComputeSystemFromOperation
HcsGetComputeSystemProperties
HcsGetOperationContext
HcsGetOperationId
HcsGetOperationResult
HcsGetOperationResultAndProcessInfo
HcsGetOperationType
HcsGetProcessFromOperation
HcsGetProcessInfo
HcsGetProcessProperties
HcsGetServiceProperties
HcsGetWorkerProcessJob
HcsGrantVmAccess
HcsModifyComputeSystem
HcsModifyProcess
HcsModifyServiceSettings
HcsOpenComputeSystem
HcsOpenProcess
HcsPauseComputeSystem
HcsResumeComputeSystem
HcsRevokeVmAccess
HcsSaveComputeSystem
HcsSetComputeSystemCallback
HcsSetOperationCallback
HcsSetOperationContext
HcsSetProcessCallback
HcsShutDownComputeSystem
HcsSignalProcess
HcsStartComputeSystem
HcsStartVmWorkerProcess
HcsSubmitWerReport
HcsTerminateComputeSystem
HcsTerminateProcess
HcsWaitForOperationResult
HcsWaitForOperationResultAndProcessInfo

Sections

.text
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a5568fc7cb4c4a1c333fccb0a844c7a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-threadpool-l1-2-0

rpcrt4

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-trustee-l1-1-0

mpr

api-ms-win-core-file-l1-1-0

bcrypt

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-string-l1-1-0

ntdll

crypt32

oleaut32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-io-l1-1-0

xmllite

api-ms-win-core-io-l1-1-1

combase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 405KB - Virtual size: 404KB

.rdata Size: 192KB - Virtual size: 191KB

.data Size: 8KB - Virtual size: 11KB

.pdata Size: 22KB - Virtual size: 22KB

.didat Size: 512B - Virtual size: 112B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 405KB - Virtual size: 404KB

.rdata
Size: 192KB - Virtual size: 191KB

.data
Size: 8KB - Virtual size: 11KB

.pdata
Size: 22KB - Virtual size: 22KB

.didat
Size: 512B - Virtual size: 112B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB