7599ec3023e46a7f8a661273059451ee276085857fbce3e0a1794e277371ca30

Sharing

Copy URL Twitter E-mail

General

Target

7599ec3023e46a7f8a661273059451ee276085857fbce3e0a1794e277371ca30
Size

254KB
MD5

a50315f54b428a74384aceeeb54e3b10
SHA1

23a3b5ea28996199f6b831a7888cde4f45015f22
SHA256

7599ec3023e46a7f8a661273059451ee276085857fbce3e0a1794e277371ca30
SHA512

2ba19a30258e4cfb720b1f7e756fcf2bc0cb45fd10ace3f836f5f3dbe4ebc858d175b43c48a012d89db9f66d25858ab104ccdd4fe0b4aca073500e1ce1fc0dea
SSDEEP

6144:uHMLp1GDrhSKpflxDiPgpaZ3L4z3+RmJesfUp5hqqf3RBgREpxHE/gbc:o7D4LY0Z30T+GfUpfoREpxQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7599ec3023e46a7f8a661273059451ee276085857fbce3e0a1794e277371ca30

Files

7599ec3023e46a7f8a661273059451ee276085857fbce3e0a1794e277371ca30
.exe windows:6 windows x64 arch:x64

ce2f070e9f7dfa0066b9868232af10db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp140

?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
_Mtx_unlock

kernel32

AssignProcessToJobObject
CloseHandle
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateJobObjectW
CreateProcessW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageA
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleW
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessTimes
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetVolumePathNameW
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryExA
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadFile
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SearchPathW
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetCurrentDirectoryW
SetErrorMode
SetEvent
SetFileTime
SetInformationJobObject
SetLastError
SetProcessAffinityMask
SetUnhandledExceptionFilter
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegGetValueW
RegOpenKeyExA

vcruntime140

_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
_purecall
memchr
memcmp
memcpy
memmove
memset
strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vsprintf
_close
_fileno
_get_osfhandle
_lseek
_lseeki64
_open_osfhandle
_set_fmode
_setmode
_write
fflush

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_abort_behavior
_set_app_type
_set_error_mode
abort
exit
signal
terminate

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_callnewh
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

isalpha
strcmp
strlen
wcslen

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-math-l1-1-0

__setusermatherr
log10

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 28B

.rsrc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce2f070e9f7dfa0066b9868232af10db

Headers

DLL Characteristics

File Characteristics

Imports

msvcp140

kernel32

advapi32

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 218KB - Virtual size: 218KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 2KB - Virtual size: 7KB

.pdata Size: 7KB - Virtual size: 6KB

.tls Size: 512B - Virtual size: 33B

.voltbl Size: 512B - Virtual size: 28B

.rsrc Size: 1024B - Virtual size: 608B

.reloc Size: 1024B - Virtual size: 948B

.text
Size: 218KB - Virtual size: 218KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 2KB - Virtual size: 7KB

.pdata
Size: 7KB - Virtual size: 6KB

.tls
Size: 512B - Virtual size: 33B

.voltbl
Size: 512B - Virtual size: 28B

.rsrc
Size: 1024B - Virtual size: 608B

.reloc
Size: 1024B - Virtual size: 948B