367ce073e19a8cc30ff8201155afa4be7a6f238c543cf7607fcb3387ce4a1b2d

Sharing

Copy URL Twitter E-mail

General

Target

367ce073e19a8cc30ff8201155afa4be7a6f238c543cf7607fcb3387ce4a1b2d
Size

714KB
MD5

6dfc3bdd2b70670bf29506e5828f627e
SHA1

08fc2b9fb14f4392f387b83ec4e685c158f4e63f
SHA256

367ce073e19a8cc30ff8201155afa4be7a6f238c543cf7607fcb3387ce4a1b2d
SHA512

e9711326399e5b23c253fcc0e5d0e616ce0e441037c956576decd3ad8cae2791e1ad8a3d239d84cfe4ae2f5d4eb2995d8f717866e320d3782feb87f6bb100f7e
SSDEEP

12288:CdMyalSuycYn88Ic8669yO8SRmyyK+3/wap74NzoEE6IdrCOCsRIWs:CdM/8Ic8669yONYG+3Iap74NzFKdrCOM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
367ce073e19a8cc30ff8201155afa4be7a6f238c543cf7607fcb3387ce4a1b2d

Files

367ce073e19a8cc30ff8201155afa4be7a6f238c543cf7607fcb3387ce4a1b2d
.dll windows:5 windows x64 arch:x64

d873b6c9239a86f861c45239c3587d31

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\abc\Desktop\2.43\x64\Release\wam.pdb

Imports

kernel32

CreateFileW
GetFileAttributesW
GetSystemDirectoryW
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
SetCurrentDirectoryW
CreateProcessW
CopyFileW
GetDiskFreeSpaceExA
MoveFileW
CreateMutexA
OpenMutexA
CreateThread
GetVolumeInformationA
GetTickCount
GetFileSizeEx
HeapFree
GetCurrentProcess
WaitForSingleObject
GetVersionExW
MultiByteToWideChar
GetLastError
FileTimeToSystemTime
LoadLibraryW
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
GetComputerNameA
FindClose
SetFilePointer
SetErrorMode
CreatePipe
GetDriveTypeA
WriteFile
FindNextFileW
SetHandleInformation
FindFirstFileW
GetOEMCP
ReadFile
GetStartupInfoW
lstrcpyW
GetACP
WriteConsoleW
HeapSize
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetStringTypeW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetCurrentProcessId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
TerminateProcess
CreateTimerQueue
SetEvent
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetFileAttributesExW
ExitProcess
GetModuleHandleExW
ExitThread
GetModuleFileNameA

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameA
OpenProcessToken
DuplicateTokenEx
GetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerA
LookupAccountSidW
CreateProcessAsUserW

shell32

SHGetFileInfoW

ws2_32

gethostbyname
WSAStartup
gethostname
setsockopt
closesocket
inet_addr
send
socket
connect
recv
htons

psapi

GetProcessImageFileNameW

shlwapi

StrStrIW
PathFileExistsW

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory

Exports

Exports

ServiceMain

Sections

.text
Size: 495KB - Virtual size: 494KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d873b6c9239a86f861c45239c3587d31

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ws2_32

psapi

shlwapi

wtsapi32

Exports

Exports

Sections

.text Size: 495KB - Virtual size: 494KB

.rdata Size: 174KB - Virtual size: 173KB

.data Size: 14KB - Virtual size: 21KB

.pdata Size: 24KB - Virtual size: 23KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 495KB - Virtual size: 494KB

.rdata
Size: 174KB - Virtual size: 173KB

.data
Size: 14KB - Virtual size: 21KB

.pdata
Size: 24KB - Virtual size: 23KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 6KB - Virtual size: 5KB