mullvad-ping-windows[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

mullvad-ping-windows.exe
Size

71.1MB
MD5

2e996d2fe49f7a94832cf71b072cb449
SHA1

a130b300e62eaeb75c5ec3caa2725a3fdacf4f31
SHA256

c36b4425ce5a7f0ab22d818dfa071c4e04cfcdface14cbde1f7155b041c0788b
SHA512

84db3636a03fdc233610ec6f6f23b0466415c0eac071dee74273026778c3dfda69956824bc2f29bc64761ccc2882bf3385b652bbfb5780b285d44677295cef51
SSDEEP

393216:A+w608LxIXpkag/DOW/B8Re8Q/UP+Pdm3u0I99ukwVAliXUxbblHa93Whli6Z8aL:A+w2ip6v58RqWuLn9qFeQ+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mullvad-ping-windows.exe

Files

mullvad-ping-windows.exe
.exe windows:6 windows x64 arch:x64

e1c36f043f2780608d2a827f652fc815

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\deno\deno\target\release\deps\denort.pdb

Imports

kernel32

lstrlenW
GetConsoleScreenBufferInfo
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetCurrentProcess
ReleaseMutex
RtlLookupFunctionEntry
GetProcAddress
GetCurrentThread
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
WakeAllConditionVariable
ReleaseSRWLockExclusive
SleepConditionVariableSRW
GlobalUnlock
SetThreadErrorMode
LoadLibraryExW
TryAcquireSRWLockShared
FormatMessageW
CreateFileW
GetFileInformationByHandle
SetCurrentDirectoryW
GetStdHandle
CreateIoCompletionPort
GetSystemInfo
OpenProcess
GetPriorityClass
SetPriorityClass
GetFileType
GetConsoleMode
WriteConsoleInputW
PeekConsoleInputW
FlushConsoleInputBuffer
SetConsoleMode
WaitForMultipleObjects
GetNumberOfConsoleInputEvents
ResetEvent
TerminateProcess
RegisterWaitForSingleObject
CreateNamedPipeW
ConnectNamedPipe
DuplicateHandle
FreeEnvironmentStringsW
GlobalMemoryStatusEx
GetTickCount64
CreateToolhelp32Snapshot
Process32First
Process32Next
GetDiskFreeSpaceW
FreeLibrary
LoadLibraryW
WaitForSingleObject
CreateEventA
GetModuleHandleW
SetErrorMode
WideCharToMultiByte
SetFileTime
LockFileEx
UnlockFile
SetLastError
GetFullPathNameW
DeviceIoControl
UnmapViewOfFile
VirtualProtect
CreateFileMappingW
MapViewOfFile
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
WriteFile
CancelIoEx
SetFileCompletionNotificationModes
CreateSemaphoreW
CancelIo
ReadDirectoryChangesW
ReleaseSemaphore
Sleep
GetModuleHandleA
WakeConditionVariable
GlobalLock
GlobalSize
ReadConsoleInputW
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleCursorPosition
WriteConsoleW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
VirtualQuery
IsThreadAFiber
ConvertThreadToFiber
CreateFiber
SwitchToFiber
DeleteFiber
ConvertFiberToThread
MultiByteToWideChar
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
GetCurrentDirectoryW
RtlVirtualUnwind
GetEnvironmentVariableW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
SetFileInformationByHandle
GetFileInformationByHandleEx
FlushFileBuffers
GetFinalPathNameByHandleW
SetFilePointerEx
FindNextFileW
HeapReAlloc
FindFirstFileW
FindClose
ReadConsoleW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GetExitCodeProcess
CreateEventW
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
DeleteFileW
MoveFileExW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
CopyFileExW
SetHandleInformation
SetFileAttributesW
UnregisterWaitEx
GetProcessId
SetConsoleCtrlHandler
RemoveVectoredExceptionHandler
LoadLibraryExA
VirtualAlloc
VirtualFree
GetTickCount
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetFileSize
LocalFree
HeapDestroy
HeapCompact
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetNativeSystemInfo
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
GetLocaleInfoEx
IsDebuggerPresent
GetTimeZoneInformation
GetTempFileNameA
VerSetConditionMask
VerifyVersionInfoW
MapViewOfFileEx
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
QueryThreadCycleTime
GetThreadPriority
SetThreadPriority
RtlAddFunctionTable
RtlDeleteFunctionTable
FlsAlloc
FlsGetValue
FlsSetValue
GetDynamicTimeZoneInformation
GetUserGeoID
GetGeoInfoW
CreateSemaphoreA
InitializeConditionVariable
SuspendThread
GetThreadContext
ResumeThread
ResolveLocaleName
GetCurrencyFormatEx
GetNumberFormatEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDateFormatEx
GetTimeFormatEx
FindFirstFileExW
SetStdHandle
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
AcquireSRWLockExclusive
CloseHandle
SwitchToThread
CreateDirectoryW
TryAcquireSRWLockExclusive
GetDateFormatW
FlsFree
GetCommandLineA
GetConsoleOutputCP
GetCPInfo
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RaiseException
RtlPcToFileHeader
RtlUnwind

user32

CreateWindowExA
GetDC
DefWindowProcA
CloseClipboard
MapVirtualKeyW
OpenClipboard
GetClipboardData
GetClientRect
RegisterClassExA

shell32

SHGetFolderPathW
SHGetKnownFolderPath

gdi32

SetPixelFormat
GetPixelFormat
ChoosePixelFormat
DescribePixelFormat

ntdll

NtCancelIoFileEx
RtlGetVersion
NtReadFile
NtWriteFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtQuerySystemInformation

opengl32

wglCreateContext
wglGetCurrentContext
wglMakeCurrent
wglGetProcAddress
wglDeleteContext

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertGetEnhancedKeyUsage
CertVerifyTimeValidity
CertCloseStore
CertFreeCertificateContext

ole32

CoTaskMemFree

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

ws2_32

connect
accept
getsockopt
getaddrinfo
recv
freeaddrinfo
send
sendto
WSACleanup
getpeername
getsockname
ioctlsocket
socket
WSAIoctl
WSASend
WSAStartup
listen
WSASocketW
GetHostNameW
WSAGetLastError
setsockopt
closesocket
shutdown
bind
recvfrom

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
LookupPrivilegeValueW
OpenProcessToken
SystemFunction036
GetUserNameW
AdjustTokenPrivileges
EventSetInformation
EventWriteTransfer
EventRegister
RegQueryInfoKeyW
RegEnumKeyExW

psapi

GetProcessMemoryInfo
GetPerformanceInfo

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

d3dcompiler_47

D3DCompile

oleaut32

SysFreeString
SysStringLen
GetErrorInfo

dbghelp

SymSetSearchPathW
SymSetOptions
SymFunctionTableAccess64
StackWalk64
SymFromAddr
SymGetSearchPathW
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64

Exports

Exports

CrashForExceptionInNonABICompliantCodeRange

Sections

.text
Size: 42.2MB - Virtual size: 42.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26.6MB - Virtual size: 26.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 207KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1c36f043f2780608d2a827f652fc815

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

gdi32

ntdll

opengl32

crypt32

ole32

winmm

ws2_32

advapi32

psapi

iphlpapi

bcrypt

d3dcompiler_47

oleaut32

dbghelp

Exports

Exports

Sections

.text Size: 42.2MB - Virtual size: 42.2MB

.rdata Size: 26.6MB - Virtual size: 26.6MB

.data Size: 207KB - Virtual size: 358KB

.pdata Size: 1.6MB - Virtual size: 1.6MB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 109KB - Virtual size: 108KB

.reloc Size: 189KB - Virtual size: 189KB

.text
Size: 42.2MB - Virtual size: 42.2MB

.rdata
Size: 26.6MB - Virtual size: 26.6MB

.data
Size: 207KB - Virtual size: 358KB

.pdata
Size: 1.6MB - Virtual size: 1.6MB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 109KB - Virtual size: 108KB

.reloc
Size: 189KB - Virtual size: 189KB