2024-04-15_b1f1693619b3319d50dbd11786d80c9d_ekans

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-15_b1f1693619b3319d50dbd11786d80c9d_ekans
Size

15.0MB
MD5

b1f1693619b3319d50dbd11786d80c9d
SHA1

e258e7dce5f7a502bccba8141fe1bd0fb6598f5c
SHA256

f278f34532971685efd9574317e7d82ea4e7691df92a7771d0d91c5322a747c6
SHA512

590be9dd18bad8406046d87c7355ff38a38f745ef926f3ae5ad1ab82f51c974e6346321934cc343d4d7cc127603f5a2bcc0dfaeb24a77410b2a4f8b823d99dd5
SSDEEP

98304:d4TWZKgMij91mZHHU9HBAUZLeZB26xX5nTATY+olQcywURt6F8gvA5L:dAWZpSHHU9HVyBpdTAfSYJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-15_b1f1693619b3319d50dbd11786d80c9d_ekans

Files

2024-04-15_b1f1693619b3319d50dbd11786d80c9d_ekans
.exe windows:6 windows x64 arch:x64

b0bda2e3556360236a405a8b68f23d3b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetACP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
PostQueuedCompletionStatus
QueryPerformanceCounter
RaiseFailFastException
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TerminateProcess
TlsAlloc
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WriteConsoleW
WriteFile
__C_specific_handler

msvcrt

__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_cexit
_errno
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
qsort
setlocale
signal
sprintf
strchr
strcmp
strlen
strncmp
strrchr
vfprintf

dguardnet_v2.5.1_64

DGC_CheckLicense
DGC_Close
DGC_Create_Key_Pair
DGC_Decode_Base64
DGC_Decode_Hex
DGC_Decrypt
DGC_Digest
DGC_Encode_Base64
DGC_Encode_Hex
DGC_Encrypt
DGC_Get_Random
DGC_Init
DGC_KEK_Decrypt
DGC_KEK_Encrypt
DGC_Private_Decrypt
DGC_Private_Sign
DGC_Pub_Digest
DGC_Public_Encrypt
DGC_Public_Verify
DGC_Token_Decrypt
DGC_Token_Encrypt
DGC_Version

Exports

Exports

_cgo_dummy_export

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 371KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 371KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 868KB - Virtual size: 868KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 338KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 927KB - Virtual size: 927KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/106
Size: 512B - Virtual size: 39B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0bda2e3556360236a405a8b68f23d3b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

dguardnet_v2.5.1_64

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.data Size: 371KB - Virtual size: 371KB

.rdata Size: 3.5MB - Virtual size: 3.5MB

.pdata Size: 70KB - Virtual size: 69KB

.xdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 371KB

.edata Size: 512B - Virtual size: 78B

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 56KB - Virtual size: 56KB

/4 Size: 1024B - Virtual size: 624B

/19 Size: 2.6MB - Virtual size: 2.6MB

/31 Size: 5KB - Virtual size: 5KB

/45 Size: 868KB - Virtual size: 868KB

/57 Size: 338KB - Virtual size: 337KB

/70 Size: 1KB - Virtual size: 1KB

/81 Size: 3.1MB - Virtual size: 3.1MB

/92 Size: 927KB - Virtual size: 927KB

/106 Size: 512B - Virtual size: 39B

.text
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 371KB - Virtual size: 371KB

.rdata
Size: 3.5MB - Virtual size: 3.5MB

.pdata
Size: 70KB - Virtual size: 69KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 371KB

.edata
Size: 512B - Virtual size: 78B

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 56KB - Virtual size: 56KB

/4
Size: 1024B - Virtual size: 624B

/19
Size: 2.6MB - Virtual size: 2.6MB

/31
Size: 5KB - Virtual size: 5KB

/45
Size: 868KB - Virtual size: 868KB

/57
Size: 338KB - Virtual size: 337KB

/70
Size: 1KB - Virtual size: 1KB

/81
Size: 3.1MB - Virtual size: 3.1MB

/92
Size: 927KB - Virtual size: 927KB

/106
Size: 512B - Virtual size: 39B