8e9ecd282655f0afbdb6bd562832ae6db108166022eb43ede31c9d7aacbcc0d8

Sharing

Copy URL Twitter E-mail

General

Target

8e9ecd282655f0afbdb6bd562832ae6db108166022eb43ede31c9d7aacbcc0d8
Size

2.3MB
MD5

6791c80a35d77601962db1509764d049
SHA1

45b33e6ca9139465cf281280f3e4f7ce390db203
SHA256

8e9ecd282655f0afbdb6bd562832ae6db108166022eb43ede31c9d7aacbcc0d8
SHA512

7e1b44129fbddcbc4e1e3b3ff16c09adaa744721d095cc32dea2c57d9ca819c7562f1ad0272df9e698508541280a357d7ef5bb17bccca51a87e4c1f959e9f749
SSDEEP

49152:akOzgbmhpREd2YxoCsMQ+DdGG0015uQ/VYudj9IU6iW:Z6EsWg0u+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e9ecd282655f0afbdb6bd562832ae6db108166022eb43ede31c9d7aacbcc0d8

Files

8e9ecd282655f0afbdb6bd562832ae6db108166022eb43ede31c9d7aacbcc0d8
.exe windows:6 windows x64 arch:x64

d85aaca4e85fb5a2b5bf0158ad821961

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\CodeProject\hw_src\NPSC2\npc\target\release\deps\npc.pdb

Imports

kernel32

FindClose
SetFilePointerEx
MoveFileExW
FindFirstFileW
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
AddVectoredExceptionHandler
SetThreadStackGuarantee
RemoveDirectoryW
DeleteFileW
GetSystemInfo
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
GetModuleHandleA
GetProcAddress
TryEnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
WriteConsoleW
SetLastError
GetCurrentDirectoryW
GetCurrentProcess
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
EnterCriticalSection
InitializeCriticalSection
GetFullPathNameW
FindNextFileW
CreateDirectoryW
SetHandleInformation
ReadFileEx
SleepEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetFileAttributesW
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
CreateNamedPipeW
DuplicateHandle
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CreateEventW
CancelIo
ReadFile
QueryPerformanceCounter
SetCurrentDirectoryW
GetSystemTimeAsFileTime
AcquireSRWLockShared
ReleaseSRWLockShared
CopyFileExW
CreateThread
ReadProcessMemory
LocalFree
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
OpenProcess
VirtualQueryEx
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
RtlVirtualUnwind
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
DeleteCriticalSection
GetCurrentThreadId
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
Sleep
GetCurrentProcessId
GetComputerNameExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLastError
WaitForSingleObject
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SwitchToThread
CloseHandle
HeapReAlloc
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
HeapFree

ntdll

NtQueryInformationProcess
RtlGetVersion
NtQuerySystemInformation

advapi32

RegQueryValueExW
GetUserNameW
SystemFunction036
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData

iphlpapi

GetExtendedUdpTable
GetIfTable2
FreeMibTable
GetExtendedTcpTable

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetQueryDisplayInformation

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantClear

pdh

PdhCloseQuery
PdhCollectQueryData
PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

EnumProcessModulesEx
GetModuleFileNameExW
GetPerformanceInfo

shell32

CommandLineToArgvW

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

ws2_32

send
WSASend
setsockopt
recv
WSAStartup
closesocket
ioctlsocket
connect
WSAGetLastError
select
bind
getsockname
freeaddrinfo
getsockopt
WSACleanup
getaddrinfo
WSASocketW

vcruntime140

memcpy
__CxxFrameHandler3
memmove
memcmp
strrchr
__C_specific_handler
__current_exception_context
memset
__current_exception

api-ms-win-crt-string-l1-1-0

strlen
strcspn
strcmp
wcslen
strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
realloc
free
_msize

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initterm
_register_onexit_function
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
terminate
_initterm_e
_get_initial_narrow_environment
__p___argv
__p___argc
_initialize_narrow_environment
_exit
_beginthreadex
_endthreadex
_seh_filter_exe
_set_app_type
_configure_narrow_argv
exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 602KB - Virtual size: 601KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d85aaca4e85fb5a2b5bf0158ad821961

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ntdll

advapi32

bcrypt

crypt32

iphlpapi

netapi32

ole32

oleaut32

pdh

powrprof

psapi

shell32

dxgi

d3d11

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 602KB - Virtual size: 601KB

.data Size: 10KB - Virtual size: 14KB

.pdata Size: 49KB - Virtual size: 49KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 602KB - Virtual size: 601KB

.data
Size: 10KB - Virtual size: 14KB

.pdata
Size: 49KB - Virtual size: 49KB

.reloc
Size: 14KB - Virtual size: 14KB