03da059ed5fd49814cba50e3d42f89706809fdcb422cb6e44940bb49d1ffa13f

Sharing

Copy URL Twitter E-mail

General

Target

03da059ed5fd49814cba50e3d42f89706809fdcb422cb6e44940bb49d1ffa13f
Size

446KB
MD5

440722f7c3436e44fd05f8d18746cc60
SHA1

7dc0aeca64c721133d4023f5fb038333a64468af
SHA256

03da059ed5fd49814cba50e3d42f89706809fdcb422cb6e44940bb49d1ffa13f
SHA512

52b706d06aac5ffea897188330ef74c27075c2b3121c56a157b712a37f89e1efaa7f1325db5bc2ff3179821c98e9ecb2736f8638309f9eb12ed556fba599a595
SSDEEP

6144:Q6MaQLNaPmDYjykjeCH5kEkNUfaSaUjpgfUBMUQq3ykzSr9:lQLNaPmlkje+kjOf1lyJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03da059ed5fd49814cba50e3d42f89706809fdcb422cb6e44940bb49d1ffa13f

Files

03da059ed5fd49814cba50e3d42f89706809fdcb422cb6e44940bb49d1ffa13f
.exe windows:6 windows x64 arch:x64

4f55e32f8515d853a0340d0af8dc94f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrlenW
ResumeThread
HeapAlloc
GetProcAddress
ReadProcessMemory
GetProcessHeap
CreateProcessW
GetModuleHandleW
lstrcpyW
LoadLibraryA
ReadFile
WriteFile
CreateFileA
DeleteFileA
CloseHandle
HeapFree
GetCurrentProcess
GetTempPathW
Sleep
OpenThread
GetStdHandle
WriteConsoleA
GetModuleFileNameW
CreateFileW
SetFileInformationByHandle
WriteConsoleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WriteProcessMemory
GetLastError
GetFileSize
GetTempPathA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter

user32

wsprintfA
wsprintfW

advapi32

OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW

ws2_32

htons
WSACleanup
closesocket
WSAGetLastError
WSAStartup
ntohl
inet_pton
connect
socket
send

vcruntime140

__current_exception
__current_exception_context
strchr
__C_specific_handler
memset

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_initterm_e
_exit
exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
perror
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vswprintf
_kbhit
fwrite
fclose
fopen
__stdio_common_vfwprintf
__stdio_common_vsprintf
_getcwd
__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-environment-l1-1-0

_wgetcwd

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-string-l1-1-0

_strdup
wcsncmp
strcmp
strncpy

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-time-l1-1-0

wcsftime
_time64
_localtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f55e32f8515d853a0340d0af8dc94f5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 416KB - Virtual size: 416KB

.pdata Size: 1024B - Virtual size: 552B

.reloc Size: 512B - Virtual size: 48B

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 416KB - Virtual size: 416KB

.pdata
Size: 1024B - Virtual size: 552B

.reloc
Size: 512B - Virtual size: 48B