72cfb265ac2812786e71150f7d8b8c429c80dbd73a1cd3bfc495353ceaa020b7

Sharing

Copy URL Twitter E-mail

General

Target

72cfb265ac2812786e71150f7d8b8c429c80dbd73a1cd3bfc495353ceaa020b7
Size

1.3MB
MD5

fd699926914fdc77779854ba6d4cb39f
SHA1

13198021634eb38f4e7f29a70f28de7b7d8459fc
SHA256

72cfb265ac2812786e71150f7d8b8c429c80dbd73a1cd3bfc495353ceaa020b7
SHA512

389dd83401a5789096f93e884ff4b445893903e9b6401cfb1e3281fd94ec42a76f7a636f9fbb99cd509ce99256816b6778fa8b975a178505973054d2c90dd1a0
SSDEEP

24576:rxqheBSkPkD72dowc/tyQOqvuK6AaBzZO3gYPtejjz1uTauHbgqLl:rxqheBSkPkD72dowc/tyQOqvuK6AaBzO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72cfb265ac2812786e71150f7d8b8c429c80dbd73a1cd3bfc495353ceaa020b7

Files

72cfb265ac2812786e71150f7d8b8c429c80dbd73a1cd3bfc495353ceaa020b7
.exe windows:6 windows x64 arch:x64

dc3f0ee487963ea656964baf4e842636

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetPriorityClass
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
OpenProcess
QueryFullProcessImageNameA
TerminateProcess
FormatMessageA
LocalFree
CreateProcessA
GetLastError
VirtualAlloc
VirtualFree
K32EnumProcessModules
K32GetModuleBaseNameA
K32GetModuleInformation
GetModuleHandleA
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
ReleaseMutex
CreateMutexA
OpenMutexA
LockResource
LoadResource
SizeofResource
FindResourceA

user32

GetSystemMetrics
LoadImageA
SetWinEventHook
MessageBoxA
GetWindowThreadProcessId

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_cexit
abort
terminate

vcruntime140

__CxxFrameHandler3
__std_exception_copy
memmove
__std_exception_destroy
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
__FrameUnwindFilter
memset
_CxxThrowException
__current_exception
__CxxQueryExceptionSize
__current_exception_context
__CxxExceptionFilter
memcpy

msvcp140

_Thrd_sleep
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency

api-ms-win-crt-math-l1-1-0

ceilf

mscoree

_CorExeMain

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc3f0ee487963ea656964baf4e842636

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

vcruntime140

msvcp140

api-ms-win-crt-math-l1-1-0

mscoree

Sections

.text Size: 40KB - Virtual size: 39KB

.nep Size: 1024B - Virtual size: 576B

.rdata Size: 94KB - Virtual size: 94KB

.data Size: 1024B - Virtual size: 6KB

.pdata Size: 512B - Virtual size: 324B

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 512B - Virtual size: 84B

.text
Size: 40KB - Virtual size: 39KB

.nep
Size: 1024B - Virtual size: 576B

.rdata
Size: 94KB - Virtual size: 94KB

.data
Size: 1024B - Virtual size: 6KB

.pdata
Size: 512B - Virtual size: 324B

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 512B - Virtual size: 84B