2024-04-20_61e48719691b63f3cb571cd54a4116e5_polyvice

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-20_61e48719691b63f3cb571cd54a4116e5_polyvice
Size

1.3MB
MD5

61e48719691b63f3cb571cd54a4116e5
SHA1

35daee089b9241e7675248c515ed5a5e4a10fedc
SHA256

5d13103ecb3ad87d9a70767c03c5a1d22a097f1de89b72a3e958f1a7a133f220
SHA512

2b97d49c1107a92ed6189af8cdbebebce83c41c45664d1a77fc796465ababc3e9126d57c000f348d0aad07a28257ffe0039b8e200f788aa3e89ff08376d83059
SSDEEP

12288:bcyl3vfHMgLUmilsv5WLjF8MzhBgj0/BJi03eow0Gn07UTo6mgf1juHdc/:wo/0Yv5iGnMUToa1uHdc/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-20_61e48719691b63f3cb571cd54a4116e5_polyvice

Files

2024-04-20_61e48719691b63f3cb571cd54a4116e5_polyvice
.exe windows:4 windows x64 arch:x64

fbb586e7d8d98ef8248c31d1990b8449

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA

iphlpapi

GetAdaptersInfo
GetBestInterface
GetIpInterfaceEntry
InitializeIpInterfaceEntry
SetIpInterfaceEntry

kernel32

CloseHandle
CreateEventA
CreateFileA
CreateThread
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FormatMessageW
GetLastError
GetLocalTime
GetOverlappedResult
InitializeCriticalSection
LeaveCriticalSection
ReadFile
ResetEvent
SetConsoleCtrlHandler
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile

api-ms-win-crt-convert-l1-1-0

atoi
strtol
strtoul
wcstombs

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron
getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler
memcmp
memcpy
memmove
strchr
strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_exit
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror
system

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
fclose
fflush
fgets
fopen
fwrite
putchar
puts

api-ms-win-crt-string-l1-1-0

_strdup
isspace
memset
strcmp
strcpy
strlen
strncmp
strncpy
strtok

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_localtime64
_mktime64
_time64
_tzset
clock
strftime

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getnameinfo
getsockname
htonl
htons
inet_addr
inet_ntoa
inet_ntop
ioctlsocket
ntohl
ntohs
recvfrom
select
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 498KB - Virtual size: 498KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbb586e7d8d98ef8248c31d1990b8449

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

ws2_32

Sections

.text Size: 184KB - Virtual size: 184KB

.data Size: 512B - Virtual size: 464B

.rdata Size: 40KB - Virtual size: 40KB

.pdata Size: 4KB - Virtual size: 4KB

.xdata Size: 4KB - Virtual size: 4KB

.bss Size: - Virtual size: 6KB

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 292B

/4 Size: 1KB - Virtual size: 1KB

/19 Size: 498KB - Virtual size: 498KB

/31 Size: 26KB - Virtual size: 25KB

/45 Size: 184KB - Virtual size: 183KB

/57 Size: 20KB - Virtual size: 19KB

/70 Size: 4KB - Virtual size: 4KB

/81 Size: 11KB - Virtual size: 11KB

/97 Size: 244KB - Virtual size: 244KB

/113 Size: 45KB - Virtual size: 45KB

.text
Size: 184KB - Virtual size: 184KB

.data
Size: 512B - Virtual size: 464B

.rdata
Size: 40KB - Virtual size: 40KB

.pdata
Size: 4KB - Virtual size: 4KB

.xdata
Size: 4KB - Virtual size: 4KB

.bss
Size: - Virtual size: 6KB

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 292B

/4
Size: 1KB - Virtual size: 1KB

/19
Size: 498KB - Virtual size: 498KB

/31
Size: 26KB - Virtual size: 25KB

/45
Size: 184KB - Virtual size: 183KB

/57
Size: 20KB - Virtual size: 19KB

/70
Size: 4KB - Virtual size: 4KB

/81
Size: 11KB - Virtual size: 11KB

/97
Size: 244KB - Virtual size: 244KB

/113
Size: 45KB - Virtual size: 45KB