b256f6bd3da37a6cc33a49a87588123f06bf0c705b86611acf3d58d885a8805c

Sharing

Copy URL Twitter E-mail

General

Target

b256f6bd3da37a6cc33a49a87588123f06bf0c705b86611acf3d58d885a8805c
Size

1.5MB
MD5

fdf67fe277393abf0815feb2bedc9e1a
SHA1

a134122136248ce76c868ca1de1e79469d4c9e7d
SHA256

b256f6bd3da37a6cc33a49a87588123f06bf0c705b86611acf3d58d885a8805c
SHA512

7dc5ab10ea0aa55dbf441eff41d181c4ea173c88d26e345200dde5f5e6123c5f37b4ee1b975d0ffba680d180ff13dc323fa20f44ff3c672958ca81d5d2351526
SSDEEP

12288:OqaHHFiU931i7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:OhH193U7sqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b256f6bd3da37a6cc33a49a87588123f06bf0c705b86611acf3d58d885a8805c

Files

b256f6bd3da37a6cc33a49a87588123f06bf0c705b86611acf3d58d885a8805c
.exe windows:6 windows x64 arch:x64

40cb3c31cc8813e43a245f6cd2739eff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Z:\b\cnss_proc\bt\App\Bin\x64\Release\AdminService.pdb

Imports

bluetoothapis

BluetoothSetLocalServiceInfo
BluetoothFindRadioClose
BluetoothGetRadioInfo
BluetoothFindFirstRadio

ole32

StringFromGUID2
CLSIDFromString

shlwapi

StrCmpW
PathRemoveFileSpecW

cfgmgr32

CM_Reenumerate_DevNode_Ex
CM_Get_Device_ID_ExW
CM_Disconnect_Machine
CM_Locate_DevNode_ExW
CM_Connect_MachineW
CM_Get_DevNode_Status
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Free_Res_Des_Handle
CM_Free_Log_Conf_Handle
CM_Get_DevNode_Status_Ex

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiCreateDeviceInfoW
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiClassGuidsFromNameExW
SetupDiSetDeviceRegistryPropertyW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInfoListDetailW
SetupDiCallClassInstaller
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceInstallParamsW
SetupDiOpenClassRegKeyExW
SetupDiGetDriverInstallParamsW
SetupFindFirstLineW
SetupDiSetDeviceInstallParamsW
SetupOpenInfFileW
SetupGetStringFieldW
SetupDiBuildDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiEnumDriverInfoW
SetupDiDestroyDriverInfoList
SetupCloseInfFile
SetupDiOpenDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoListExW
SetupDiClassNameFromGuidExW
SetupCopyOEMInfW

powrprof

CallNtPowerInformation

kernel32

GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
RtlPcToFileHeader
FindFirstFileW
GetCurrentProcess
DeviceIoControl
GetModuleFileNameW
FindClose
WaitForSingleObject
CreateFileW
ResumeThread
CreateEventW
GetExitCodeThread
Sleep
GetLastError
OutputDebugStringW
SetEvent
TerminateThread
GlobalFree
CloseHandle
LoadLibraryW
CreateThread
ResetEvent
GetLocalTime
GetProcAddress
GlobalLock
ExitProcess
GetModuleHandleW
FreeLibrary
GetTickCount
GlobalUnlock
GetFileType
GetFullPathNameW
FindNextFileW
lstrlenW
GetFileAttributesW
GetWindowsDirectoryW
SizeofResource
HeapFree
GetSystemPowerStatus
InitializeCriticalSectionEx
GetVersionExW
HeapSize
GetPrivateProfileStringW
LockResource
HeapReAlloc
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetPrivateProfileSectionW
GetNativeSystemInfo
FormatMessageW
LocalFree
FileTimeToSystemTime
GetDateFormatW
WideCharToMultiByte
WriteFile
GetCurrentThreadId
GetCurrentProcessId
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
CompareStringW
LCMapStringW
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetEnvironmentVariableW
GlobalAlloc
RtlCaptureContext
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection

user32

DispatchMessageW
GetMessageW
CharNextW
TranslateMessage
PostThreadMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
LoadStringW
CharPrevW

advapi32

OpenSCManagerW
RegEnumValueW
OpenServiceW
RegDeleteValueW
StartServiceCtrlDispatcherW
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
InitiateSystemShutdownExW
QueryServiceStatus
RegDeleteKeyExW
LookupPrivilegeValueW
RegisterServiceCtrlHandlerExW
AdjustTokenPrivileges
CreateServiceW
RegCloseKey
RegQueryInfoKeyW
CloseServiceHandle
RegQueryValueExW
SetServiceStatus
ChangeServiceConfig2W
RegCreateKeyExW
DeleteService
ControlService
RegEnumKeyExW
RegDeleteTreeW
RegSetValueExW
OpenProcessToken
StartServiceW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

40cb3c31cc8813e43a245f6cd2739eff

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bluetoothapis

ole32

shlwapi

cfgmgr32

setupapi

powrprof

kernel32

user32

advapi32

shell32

version

Sections

.text Size: 198KB - Virtual size: 197KB

.rdata Size: 101KB - Virtual size: 100KB

.data Size: 7KB - Virtual size: 13KB

.pdata Size: 10KB - Virtual size: 9KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 47KB - Virtual size: 46KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 198KB - Virtual size: 197KB

.rdata
Size: 101KB - Virtual size: 100KB

.data
Size: 7KB - Virtual size: 13KB

.pdata
Size: 10KB - Virtual size: 9KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 47KB - Virtual size: 46KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB