6b803c31fbc72f37afb24a34c83e5d010b3187e0a942148ecfbd93a06f08a729

Sharing

Copy URL Twitter E-mail

General

Target

6b803c31fbc72f37afb24a34c83e5d010b3187e0a942148ecfbd93a06f08a729
Size

1.4MB
MD5

fdef7afe646bb104091bd99fbe9d15d8
SHA1

df93c763d03f16462ed12402fe480484f98c113d
SHA256

6b803c31fbc72f37afb24a34c83e5d010b3187e0a942148ecfbd93a06f08a729
SHA512

79acbd98f387c4d795a56ea650a73f4e2e60cedec94e35bbf5ed2e219b9fafd0df64c5615e2d20c507039a4f033c26eccbefe4ba12610a82b761f1f85723fac0
SSDEEP

3072:J8NrZt+lC2KMsx0mKdih6OoQ9QP6NElkpW1:J6t+uGmKwoCQP6NElkpW1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b803c31fbc72f37afb24a34c83e5d010b3187e0a942148ecfbd93a06f08a729

Files

6b803c31fbc72f37afb24a34c83e5d010b3187e0a942148ecfbd93a06f08a729
.exe windows:6 windows x86 arch:x86

ccd5ed60361440d14be0b5e2305da5d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\00\mt-1478\bin\Debug\SFQDevStart.pdb

Imports

json

??1Value@Json@@QAE@XZ
??AValue@Json@@QAEAAV01@PBD@Z
?asString@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0Value@Json@@QAE@W4ValueType@1@@Z

common

?ReadJsonValue@@YG_NABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVValue@Json@@@Z

kernel32

InitializeCriticalSectionAndSpinCount
DecodePointer
GetLastError
SetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
FreeLibrary
MultiByteToWideChar
GetCurrentDirectoryA
GetVersionExA
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
WideCharToMultiByte
RaiseException
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
DeleteCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
OutputDebugStringA

user32

GetKeyState
GetSystemMetrics
PeekMessageA
UnregisterClassA
PtInRect
PostQuitMessage
mouse_event
SystemParametersInfoA
SetWindowsHookExA
CallNextHookEx
SetCursorPos

gdi32

DeleteDC

shell32

ShellExecuteA

mfc140d

ord4747
ord4808
ord11139
ord17051
ord9454
ord17053
ord14523
ord14524
ord2884
ord12131
ord6440
ord9960
ord9532
ord5490
ord14942
ord15010
ord12187
ord14137
ord10043
ord1599
ord3021
ord5142
ord9109
ord10143
ord2558
ord1528
ord1220
ord1036
ord1646
ord1880
ord9771
ord322
ord316
ord1141
ord1674
ord5752
ord10140
ord8230
ord4524
ord378
ord4240
ord4210
ord371
ord3854
ord3872
ord481
ord3873
ord15177
ord15446
ord5553
ord3111
ord1215
ord963
ord1512
ord2878
ord4326
ord14046
ord3847
ord3967
ord3966
ord4586
ord13999
ord3217
ord6518
ord9476
ord16538
ord7186
ord15975
ord8414
ord16531
ord3117
ord6208
ord16643
ord16437
ord10004
ord13554
ord8244
ord5696
ord15821
ord17052
ord9455
ord17054
ord3295
ord3628
ord5380
ord11437
ord6986
ord5394
ord5928
ord5867
ord5852
ord5914
ord5959
ord5882
ord5937
ord5953
ord5894
ord5900
ord5906
ord5888
ord5943
ord5876
ord2027
ord2006
ord2020
ord1994
ord1972
ord14155
ord14159
ord16191
ord3848
ord12807
ord11118
ord13474
ord12442
ord12484
ord13513
ord8405
ord4729
ord3086
ord5382
ord10692
ord17046
ord13785
ord4462
ord4467
ord13963
ord10874
ord13563
ord13562
ord6798
ord12039
ord12035
ord12037
ord12038
ord12036
ord17243
ord9816
ord12005
ord3890
ord3893
ord3745
ord3744
ord4007
ord4006
ord12225
ord13218
ord12821
ord10769
ord2925
ord5026
ord10947
ord3309
ord16040
ord7506
ord14006
ord2581
ord10084
ord985
ord16153
ord7898
ord493
ord14051
ord10973
ord8952
ord17057
ord17058
ord2610
ord2371
ord13838
ord13837
ord16915
ord14513
ord9535
ord17125
ord7684
ord17127
ord7686
ord17126
ord7685
ord16241
ord1090
ord8222
ord4483
ord7159
ord14129
ord9825
ord14147
ord14097
ord1218
ord4749
ord6274
ord6678
ord6956
ord11091
ord6648
ord6959
ord6277
ord6506
ord6256
ord9208
ord9209
ord9198
ord6504
ord9829
ord12000
ord10946
ord1170
ord1171
ord15253
ord1655
ord1645
ord1653
ord2777
ord2773
ord15029
ord15206
ord2801

comctl32

InitCommonControlsEx

gdiplus

GdiplusShutdown

msvcp140d

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z

vcruntime140d

__vcrt_LoadLibraryExW
memmove
__vcrt_GetModuleFileNameW
__std_type_info_destroy_list
_except_handler4_common
__current_exception_context
__current_exception
__CxxFrameHandler3
memset
__vcrt_GetModuleHandleW

ucrtbased

terminate
strcpy_s
strcat_s
__stdio_common_vsprintf_s
__p__commode
_wmakepath_s
_wsplitpath_s
_invalid_parameter_noinfo
_errno
_recalloc
_controlfp_s
_configthreadlocale
_register_thread_local_exe_atexit_callback
_c_exit
_set_fmode
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
__setusermatherr
_set_app_type
_seh_filter_exe
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_CrtDbgReport
_invalid_parameter
_CrtDbgReportW
malloc
free
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf_s
wcslen
wcscpy_s
_setmbcp
_set_new_mode

oleaut32

SysFreeString

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 965KB - Virtual size: 965KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ccd5ed60361440d14be0b5e2305da5d4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

json

common

kernel32

user32

gdi32

shell32

mfc140d

comctl32

gdiplus

msvcp140d

vcruntime140d

ucrtbased

oleaut32

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 404KB - Virtual size: 404KB

.data Size: 1KB - Virtual size: 12KB

.idata Size: 8KB - Virtual size: 7KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 965KB - Virtual size: 965KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 404KB - Virtual size: 404KB

.data
Size: 1KB - Virtual size: 12KB

.idata
Size: 8KB - Virtual size: 7KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 965KB - Virtual size: 965KB

.reloc
Size: 10KB - Virtual size: 9KB